The Nari Accountant plugin contains a stored cross‑site scripting flaw in its account settings pages caused by insufficient input sanitization and output escaping. The flaw permits authenticated users with editor privileges or higher to inject arbitrary JavaScript that is then rendered for any user who visits the affected page. The injection can lead to session hijacking, defacement or malware delivery within the site’s context. Based on the description, the attack vector requires that the attacker be logged in and possess at least editor rights, but is otherwise straightforward to exploit once those conditions are met.

WordPress installations running the Nari Accountant plugin version 1.0.12 or earlier on a multi‑site setup or where the unfiltered_html capability has been disabled. The vulnerability is specific to the Nari Accountant product, which is distributed by shakhi.

The CVSS score of 4.4 classifies the vulnerability as moderate, but the EPSS score of less than 1% indicates an extremely low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, reflecting its limited public exploitation potential. Because the exploit requires authenticated editor or higher access, the risk is constricted to sites with many such users or where roles are mis‑assigned, yet the impact remains significant for any impacted site.