The Saitama Addon Pack WordPress plugin through version 1.0.8 contains a stored XSS vulnerability (CWE-79) due to improper sanitization and escaping of post metadata values. Users with contributor-level permissions or above can inject malicious JavaScript payloads into post metadata fields. When a user with higher privileges reviews the content, the injected scripts execute in their browser context, potentially leading to session hijacking, privilege escalation, or other browser-based attacks. No CVSS score or official remediation guidance is currently available, and no known exploits are reported in the wild.

This vulnerability allows an attacker with contributor-level access to inject stored malicious scripts that execute in the browsers of higher-privileged users. This can lead to unauthorized actions performed with elevated privileges, theft of sensitive information, or compromise of user sessions. The impact is limited to environments where untrusted users have contributor or higher access and where higher-privileged users review the injected content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and avoid reviewing untrusted content in the plugin's post metadata fields. Monitor vendor channels for updates and apply patches promptly once released.