The StaffList plugin for WordPress allows authenticated attackers with administrator‑level privileges to inject arbitrary JavaScript via the admin settings page. Because the plugin fails to sanitize input and escape output, the injected script is stored and executed whenever any user views the affected page. The flaw only exists when the site is a multi‑site installation and the unfiltered_html filter is disabled, limiting the scope to a subset of WordPress configurations, but it still permits the delivery of malicious payloads to all site users.

WordPress sites that install StaffList version 3.2.6 or earlier. Vulnerability appears only on multisite deployments where the unfiltered_html capability has been removed. Administrators or accounts with alphanumeric higher privileges can use the plugin’s settings page to inject scripts. Older or single‑site installations, or those with unfiltered_html enabled, are not affected.

The CVSS score of 4.4 reflects that the vulnerability is a moderate severity stored XSS that requires authenticated access and a specific site configuration. The EPSS score of < 1% indicates a very low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog, further suggesting limited exploitation activity. The attacker must be able to reach the Admin Settings interface to submit the payload, which reduces the attack surface. Nonetheless, because any authenticated user can exercise admin‑level privileges on a multisite platform, the potential impact of the delivered script could be widespread if an admin account is compromised.