The Makesweat plugin for WordPress suffers a stored cross‑site scripting flaw that allows an authenticated user with administrator privileges, or higher, to inject arbitrary JavaScript into the 'makesweat_clubid' configuration setting. The input is neither sanitized nor escaped before being stored, meaning that any user who later views a page containing the affected setting will execute the injected script. Because the script runs in the context of the visitor, attackers can steal session cookies, deface the site, or perform phishing. The vulnerability does not provide remote code execution on the server, but it can undermine the confidentiality and integrity of site users and compromise the trust relationship with the site.

It affects the Makesweat WordPress plugin, versions up to and including 0.1. The vulnerability exists in all builds up to that version, and users of the 0.1 release or older are susceptible. No later versions have been explicitly listed as affected, but verification is recommended.

The CVSS score of 4.4 indicates a low severity, and the EPSS score of <1 % reflects a very low probability of real‑world exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers must first authenticate as an administrator or higher, which limits the attack surface to privileged accounts. The stored nature of the flaw means the malicious payload only activates when users view the compromised page, so opportunistic exploitation requires an attacker to have both administrative access and a victim viewing the page.