The MeetingList WordPress plugin contains a stored cross‑site scripting flaw in its admin settings. Attacks are limited to authenticated users with administrator or higher privileges; these users can insert arbitrary JavaScript into option values that are later rendered on front‑end pages. Once injected, the script runs each time a site visitor loads the affected page, enabling session hijacking, credential theft, or phishing. The CVSS score of 4.4 places the vulnerability in the moderate severity range, reflecting its limited impact scope and need for admin access.

The vulnerability affects all installations of the MeetingList plugin version 0.11 and earlier for the rboatright:MeetingList product. It is relevant only for WordPress multisite networks or single‑site setups where the unfiltered_html capability is disabled. Users running older versions should check the plugin page at wordpress.com/plugins/meeting-list.

Because exploitation requires an existing administrator account and the affected plugin is relatively common, the EPSS score of less than 1% indicates a low probability of widespread attack at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. In practice, an attacker would first gain or already possess admin rights, then use the plugin’s settings page to enter malicious code that is stored in the database. Subsequent viewers of the page would execute the injected script with the victim’s browser context.