The Alfie – Feed Plugin for WordPress contains a stored cross-site scripting vulnerability due to missing nonce validation and insufficient sanitization and escaping of user input in the 'naam' parameter within the alfie_option_page() function. This flaw allows unauthenticated attackers to inject persistent malicious scripts into the plugin's database, which execute when a user accesses the affected page and interacts with the injected content. The vulnerability affects all plugin versions up to 1.2.1. The CVSS 3.1 base score is 6.1, reflecting a network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality and integrity with no impact on availability. No patch or remediation details are currently available.

An unauthenticated attacker can exploit this vulnerability to perform stored cross-site scripting attacks by injecting malicious scripts via the 'naam' parameter. These scripts execute in the context of users who view the affected page and interact with the injected content, potentially leading to unauthorized actions or data exposure limited to the plugin's scope. The impact is rated medium with partial confidentiality and integrity loss but no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with links or content related to the Alfie – Feed Plugin, especially from untrusted sources. Monitoring for plugin updates and applying them promptly once released is recommended.