The Narrative Publisher WordPress plugin versions up to 1.0.7 do not restrict write access to a REST-exposed post meta field nor escape its content when rendering. This flaw allows users with contributor-level permissions or above to store JavaScript code that executes in the browser context of higher-privileged users viewing the affected post, constituting a stored Cross-Site Scripting (CWE-79) vulnerability. The CVSS 3.1 base score is 4.6, reflecting network attack vector, low attack complexity, low privileges required, and user interaction needed, with limited confidentiality and integrity impact and no availability impact. No official patch or remediation level is indicated in the available data, and no known exploits are reported in the wild.

An attacker with contributor-level access can inject malicious JavaScript into a post meta field that executes in the browsers of users with higher privileges who view the post. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or unauthorized actions performed in the context of the higher-privileged user. There is no indication of availability impact. The vulnerability requires user interaction (viewing the post) and privileges at least at the contributor level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and avoid viewing posts from untrusted contributors. Monitor vendor channels for updates or patches addressing this vulnerability.