The Hostinger Reach WordPress plugin before version 1.8.3 contains a CWE-79 Cross-Site Scripting vulnerability. Specifically, a widget setting is not properly sanitized and escaped before being rendered in the editor preview. This enables users with contributor-level access or above to inject malicious scripts that execute in the context of a higher-privileged user viewing the content in the editor, potentially leading to session hijacking or other script-based attacks.

An attacker with contributor-level access or higher can inject arbitrary JavaScript into the editor preview, which will execute in the session of a higher-privileged user who opens the affected content. This could lead to unauthorized actions performed with the higher-privileged user's credentials or session, depending on the victim's privileges and actions.

Upgrade the Hostinger Reach plugin to version 1.8.3 or later, where this vulnerability has been fixed. Since no official patch link is provided, users should verify the availability of the fix in the plugin's update notes or vendor advisory before upgrading. Avoid opening editor previews of content created by lower-privileged users until the plugin is updated.