The Same Category Posts plugin allows authenticated users with Author or higher privileges to inject arbitrary scripts by exploiting the widget title placeholder; the plugin decodes encoded HTML entities, enabling stored XSS in pages viewed by other visitors, potentially allowing cookie theft, session hijacking, or site defacement.

The vulnerability affects the kometschuh Same Category Posts plugin for WordPress in all releases up to and including 1.1.19; users running these versions should update as soon as possible.

The CVSS score of 5.4 indicates moderate risk, and the EPSS score of less than 1% shows a very low exploitation probability; the issue is not listed in CISA KEV. Attackers need only Author‑level or higher permissions to create a malicious widget title, and the injected script runs when any site visitor loads a page containing the widget.