WordPress Soliloquy Lite 2.5.6 includes a persistent cross‑site scripting vulnerability that allows an authenticated user to embed malicious script tags in the post title field. When a post is previewed, the stored script tags are executed in the preview page, allowing the attacker to run arbitrary client‑side code. This could be used to steal session cookies, deface content, or redirect users to phishing sites. The flaw is a classic stored XSS represented by CWE‑79.

The affected product is the Soliloquy Lite plugin for WordPress, version 2.5.6. No other affected versions are listed, but the vulnerability applies only to this exact release; higher or patched versions are not mentioned as vulnerable.

The CVSS score of 5.1 indicates a moderate impact. No EPSS value is available, and the flaw is not included in the CISA KEV catalog. The attack requires that the user be authenticated and possess post‑editing privileges. An attacker can exploit the vulnerability by submitting a crafted POST request to the post‑editing endpoint with a payload in the post_title parameter. Given the typical web application workload, this flaw presents a realistic risk to sites with insufficient access controls or where privileged users are compromised.