The flaw in the Related Posts Lite plugin allows an authenticated administrator to insert arbitrary scripts into the plugin’s settings. When a page that uses the affected settings is rendered, the stored script is executed in the victim’s browser, leading to the typical outcomes of a stored XSS vulnerability—session hijacking, defacement, or phishing of other site users. The potential use of the injected code for credential theft, site defacement, or phishing is inferred from the nature of stored XSS and the description of arbitrary script execution, rather than stated explicitly in the advisory.

WordPress installations running any version of Related Posts Lite 1.12 or earlier. The issue is exploitable only on network‑wide (multi‑site) blogs or on sites where the unfiltered_html capability has been disabled for ordinary administrators, meaning environments that restrict raw HTML input are at risk.

The CVSS score of 4.4 classifies the vulnerability as moderate, and the EPSS score of less than 1 % indicates a very low likelihood of exploitation at present. The vulnerability is not present in the CISA KEV catalog. Exploitation requires an attacker to first log in as an administrator or higher, after which the payload can be stored in the plugin’s settings and subsequently delivered to any site visitor.