The SUMO Reward Points plugin for WordPress is vulnerable to an unauthenticated stored XSS due to improper neutralization of input during web page generation. The vulnerability arises from the `user_has_cap` filter in the `SRP_REST_Earning_Controller` class, which grants the `rs_earning_read` capability to all users without authentication. Combined with missing sanitization of the `reason` parameter in the `create_items()` function and missing output escaping in the `column_default()` method of `SRP_Master_Log`, this allows attackers to inject arbitrary JavaScript into the reward points log. These scripts execute when administrators access the Master Log or User Reward Points admin pages, potentially leading to session hijacking or other malicious actions.

An unauthenticated attacker can inject persistent malicious scripts into the reward points log via the REST API. These scripts execute in the context of an administrator's browser when viewing specific admin pages, potentially compromising administrator sessions or performing unauthorized actions. The vulnerability impacts confidentiality and integrity but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the REST API endpoint if possible and monitor for suspicious activity. Avoid administrators accessing the affected admin pages from untrusted networks or devices. Follow vendor updates closely for an official patch or temporary mitigation.