The RandomQuotr plugin for WordPress contains a stored cross‑site scripting flaw that permits administrators to embed arbitrary JavaScript in the plugin’s configuration pages. When a user visits a page that renders the injected content, the malicious script runs in the user’s browser, enabling session hijacking, defacement, cookie theft, or other client‑side attacks. This vulnerability arises from inadequate input validation and output escaping (CWE‑79).

Any WordPress installation that uses RandomQuotr version 1.0.4 or earlier and has the unfiltered_html capability disabled—typically in multi‑site setups—can be affected. The flaw exists in all versions up to and including 1.0.4, regardless of the numeric patch level beyond that point. Administrators and accounts with higher privileges can exploit the issue by modifying the plugin’s settings.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of <1% shows a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Because the attack requires authenticated admin+ access, a viable attack surface exists only when privileged accounts are present, but the risk remains significant enough to warrant prompt remediation.