The Webling plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to inadequate input sanitization, output escaping, and missing capability checks in the 'webling_admin_save_form' and 'webling_admin_save_memberlist' functions. This allows authenticated attackers with Subscriber-level privileges or higher to inject arbitrary web scripts into forms and memberlists. These scripts execute when an administrator accesses the affected admin pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 3.9.0. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity. No patch or official remediation is currently documented.

An attacker with at least Subscriber-level access can inject persistent malicious scripts into Webling forms and memberlists. These scripts execute in the context of the WordPress administrator's browser when viewing the affected admin pages, potentially compromising administrator sessions or enabling further attacks. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild, and no official fix has been announced.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity. Administrators should be cautious when viewing Webling forms and memberlists. Consider disabling or removing the Webling plugin if possible until a patch is released.