The Key Figures WordPress plugin contains a Stored Cross-Site Scripting flaw that allows an authenticated administrator to inject arbitrary JavaScript via the kf_field_figure_default_color_render function. Because the plugin does not properly sanitize or escape user input, the injected script will run in the browser of any user who views a page that contains the malicious figure value, enabling the attacker to steal session data, deface content or potentially redirect users to malicious sites. This vulnerability exposes the confidentiality and integrity of site data to any authenticated user with administrative privileges.

All installations of the Key Figures plugin up to and including version 1.1 are affected when used on a multi‑site WordPress network or when the unfiltered_html capability has been disabled. The issue is limited to WordPress environments that deploy this plugin in those specific configurations.

The CVSS score of 4.4 places the flaw in the moderate range, while the EPSS score of less than 1% indicates a low likelihood of exploitation at this time. The vulnerability is not currently listed in the CISA KEV catalog. In practice, an attacker would need access to an administrator account in the affected WordPress network to execute the stored payload, implying that credential compromise or social engineering could be the primary exploitation path.