The AP Background WordPress plugin is vulnerable to stored cross‑site scripting through the "adv_parallax_back" shortcode. Improper input sanitization and output escaping allow an authenticated contributor to insert arbitrary scripts into pages. These scripts execute whenever a user visits the affected page, potentially compromising the user’s session, leaking data, or performing unauthorized actions.

All WordPress installations running the AP Background plugin version 3.8.2 or earlier are impacted. The plugin is distributed by the hovanesvn project. Users should verify their plugin version and upgrade if it is 3.8.2 or earlier.

The vulnerability has a CVSS score of 6.4, indicating moderate severity. The EPSS score of less than 1% suggests a very low current exploitation probability, and it is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated with contributor or higher privileges, but once achieved the injected script will be delivered to all site visitors who view the affected page. The risk to the site remains significant for an authenticated attacker possessing the required role.