The Trail Manager plugin for WordPress is vulnerable to stored Cross‑Site Scripting through its admin settings. Admin‑level or higher users can inject arbitrary JavaScript into pages via unsanitized input, causing any user who accesses the affected page to execute the injected scripts. Based on the description, it is inferred that attackers could hijack sessions, deface content, or facilitate phishing attacks once the scripts run. The weakness is a classic input validation issue identified as CWE‑79.

Users of the Trail Manager plugin version 1.0.0 and earlier from vendor phegman are impacted. The vulnerability only affects multi‑site WordPress installations where the unfiltered_html filter has been disabled. Any site that meets these conditions and keeps the plugin at an affected version is susceptible.

The CVSS score of 4.4 indicates moderate severity, while the EPSS score of less than 1 % indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated admin‑level access, so the likely vector involves privileged account compromise. Given the low exploitation probability, the potential impact on trusted users still makes timely remediation advisable.