The Carta Online WordPress plugin versions up to 2.13.0 contain a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with administrator-level permissions can inject arbitrary web scripts via the plugin's admin settings. These scripts execute when any user accesses the affected pages. The issue specifically affects multi-site installations and setups where the unfiltered_html capability is disabled, increasing the risk of script injection in these environments. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and required privileges.

An attacker with administrator-level access can exploit this vulnerability to inject malicious scripts that execute in the context of users visiting the injected pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or defacement. The vulnerability does not affect availability. It only affects multi-site WordPress installations or installations with unfiltered_html disabled, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or limiting use of the Carta Online plugin in multi-site or unfiltered_html-disabled environments. Monitor vendor channels for updates and apply patches promptly once released.