The LetterPress WordPress plugin prior to version 2.4.0 fails to properly sanitise and escape certain configuration settings. This flaw enables privileged users, such as administrators, to inject arbitrary JavaScript that is then stored and served to all site visitors, even when the unfiltered_html capability is disabled. An attacker can leverage this to hijack sessions, deface content, or execute additional malicious payloads within the context of the site.

WordPress installations using LetterPress plugin versions earlier than 2.4.0 are affected. The vulnerability applies to any WordPress site where the plugin is installed and where users have sufficient privileges to modify its settings.

The attack requires the attacker to possess administrator or equivalent privileges to modify the plugin settings. While no EPSS score or KEV listing is available, the impact of stored XSS at this privilege level is high and constitutes a severe risk. No publicly documented exploit exists, but the vulnerability is easy to exploit by any user with access to the settings interface.