The Ghost Kit – Page Builder Blocks, Motion Effects & Extensions WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the custom JS field. Authenticated attackers with Contributor-level privileges or above can inject arbitrary JavaScript code that executes in the context of users visiting the affected pages. This vulnerability affects all plugin versions up to 3.4.3. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with no availability impact. There is no vendor advisory or patch link provided, so patch status is unconfirmed.

Successful exploitation allows an authenticated user with Contributor or higher privileges to inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to unauthorized disclosure of information and modification of content within the affected site context. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict Contributor-level access carefully and consider removing or limiting use of the custom JS field in the plugin. Monitor official vendor channels for updates and apply any released fixes promptly.