The Advanced Excerpt WordPress plugin versions prior to 4.5 do not sanitize and escape a specific setting before outputting it on the front end. This flaw enables administrators, even those without unfiltered_html capability (such as in multisite environments), to perform stored Cross-Site Scripting (CWE-79) attacks. The malicious script executes in the context of site visitors, potentially compromising their security. The CVSS 3.1 base score is 4.8 (medium severity) with vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Successful exploitation allows an administrator to inject persistent malicious scripts that execute in the browsers of site visitors. This can lead to theft of user data, session hijacking, or other client-side attacks. The vulnerability affects confidentiality and integrity at a low level but does not impact availability. The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable component.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about the settings they configure in the Advanced Excerpt plugin and consider limiting administrative access. Monitoring vendor channels for updates is recommended.