The DebateMaster plugin for WordPress allows an authenticated user with administrator-level privileges to store malicious scripts in the color options configured in the plugin settings. Because the plugin renders these settings whenever a page includes the [debate] shortcode, the injected code executes automatically in the browsers of any visitor to that page, creating a stored cross‑site scripting flaw. The weakness stems from insufficient input sanitization and output escaping and is classified as CWE‑79.

WordPress installations that use DebateMaster version 1.0.0 or earlier, are part of a multi‑site network, and have the unfiltered_html capability disabled, are affected. Sites that have updated beyond 1.0.0 or do not use the plugin are not vulnerable.

The CVSS score of 4.4 indicates a moderate level of severity, while the EPSS score of less than 1 % points to a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to first gain administrator access to the WordPress site, navigate to the DebateMaster settings page, and enter malicious JavaScript into the color option fields. Once stored, the code runs for every user who views a page that calls the debate shortcode.