The Fast Velocity Minify plugin for WordPress contains a stored Cross‑Site Scripting (CWE‑79) vulnerability caused by insufficient input sanitization and output escaping in its admin settings. When an administrator injects malicious JavaScript, it is permanently stored and executes automatically whenever a user accesses a page that includes the injected setting. Attackers must first have administrator‑level or higher credentials to inject the code, and the flaw exists in all versions up to and including 3.5.1.

All WordPress installations that run Fast Velocity Minify version 3.5.1 or earlier are affected. The vulnerability applies only to multi‑site networks or installations where the unfiltered_html capability has been disabled. Only administrators can insert the malicious payload, but all visitors to a page that renders the plugin’s settings are exposed to the injected script.

The CVSS score of 4.4 indicates moderate severity, while the EPSS score of less than 1 % suggests a relatively low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is authenticated exploitation through the plugin’s admin settings, and the injected script will run on every user who visits an affected page. The flaw does not provide system‑wide compromise beyond the pages rendered by the plugin.