The Apollo13 Framework Extensions plugin for WordPress contains a stored cross‑site scripting flaw in its a13_alt_link parameter. Because the value is neither sufficiently validated nor properly escaped before being saved and later rendered, an authenticated user with Contributor privileges or higher can inject arbitrary JavaScript. When an affected page is viewed, the injected script executes in the context of any visitor, enabling session hijacking, defacement, or other client‑side attacks as described by CWE‑79.

All WordPress sites running the Apollo13 Framework Extensions plugin, versions 1.9.8 and earlier, are vulnerable. The affected product is the Apollo13 themes Apollo13 Framework Extensions, with the specific vulnerability present through version 1.9.8 inclusive. No other versions or plugins are cited as affected.

The CVSS base score is 6.4, indicating a medium risk stored XSS. The EPSS score is less than 1 %, signaling that, at the time of evaluation, the exploitation probability is low, and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must be an authenticated user with contributor-level access, which provides the necessary privileges to create the malicious payload. Once stored, the script executes automatically for any visitor, creating a persistent attack vector that can be leveraged repeatedly until the plugin is mitigated.