A stored XSS flaw exists in the WP24 Domain Check 1.6.2 plugin, allowing authenticated attackers to inject scripts via the fieldnameDomain parameter in the plugin’s settings page. The injected JavaScript runs when administrators view the page, enabling potential defacement, phishing, or credential theft. The vulnerability leverages the plugin’s lack of input sanitization and does not require remote code execution but can compromise all data accessed by administrators.

WordPress sites running the WP24 Domain Check plugin version 1.6.2 are affected. The vulnerability is specific to this plugin and its settings processing on options.php. Only installations with that plugin installed and an available fieldnameDomain input will be susceptible.

The CVSS score of 5.1 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated; however, they only need access to an administrative account to exploit the XSS. Once injected, the script executes in the administrator’s browser session, so the risk is confined to users with elevated privileges unless broader credential compromise occurs.