The Free Quotation plugin for WordPress is vulnerable to a stored cross‑site scripting flaw. By exploiting insufficient input sanitization and output escaping in the plugin's admin settings, an attacker who has administrator‑level or higher privileges can inject arbitrary JavaScript into pages rendered within the site. When a user opens the injected page, the payload executes in the context of their browser, potentially enabling session hijacking, defacement, or credential theft. The vulnerability exists only in multi‑site installations with the unfiltered_html feature disabled, meaning that normal user input is otherwise sanitized, but administrators can still inject scripts.

This flaw affects all installations of the Kris_IV Free Quotation plugin through version 3.1.6. WordPress sites configured as multisite networks and where the unfiltered_html setting is turned off are susceptible. Users and site administrators operating across any of these versions are at risk if their accounts possess administrator or higher privileges.

The CVSS score of 4.4 classifies the risk as medium, and an EPSS score of less than 1%% suggests the probability of widespread exploitation is currently very low. The vulnerability is not listed in the CISA KEV catalog, indicating no verified exploits are publicly known. However, the attacker must be authenticated as an administrator, which means the impact is most pronounced if an admin account is compromised or malicious. If exploited, the flaw can persist until the plugin is updated or the ability to inject scripts is otherwise removed.