WP‑Paginate version 2.1.3 contains a stored cross‑site scripting flaw that lets an attacker inject script content through the preset parameter when submitting a POST request to the plugin’s settings page. The payload is persisted and executed whenever an administrator later views the settings, allowing the attacker to deface the site, execute arbitrary JavaScript and potentially harvest session cookies or perform malicious actions in the administrator’s browser context.

The vulnerability affects MaxFoundry’s WP‑Paginate plugin, specifically version 2.1.3, which is used on WordPress websites. Any site running this exact version is vulnerable, regardless of other WordPress components.

The CVSS score of 5.1 indicates a moderate severity, and the exploitability requires an authenticated user with write access to the plugin’s settings. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting it may not yet be widely exploited. However, once the malicious script is stored it can impact any administrator who views the settings, potentially leading to session hijacking, credential theft, or site defacement. The lack of public exploitation data does not diminish the risk of a targeted attack exploiting this stored XSS.