The Page Keys WordPress plugin contains a stored cross‑site scripting flaw in the page_key parameter that allows any authenticated user with administrator privileges to inject arbitrary JavaScript into pages. When a user visits an affected page, the injected script executes in the victim’s browser, enabling actions such as cookie theft, session hijacking, phishing, or defacement. Because the payload is stored, the vulnerability affects every subsequent view of the modified page by any user, posing a risk to confidentiality, integrity, and availability of the site’s content.

The vulnerability exists in the Page Keys plugin from tfrommen, versions up to and including 1.3.3. It is relevant for WordPress multi‑site installations where the unfiltered_html capability is disabled and an administrator has access to modify page keys.

The CVSS score of 4.4 indicates a moderate severity, while the EPSS score of less than 1% shows a very low probability of exploitation today. The flaw is not listed in the CISA KEV catalog. An attacker must first gain administrator access before exploiting the stored XSS; the attack vector is therefore a local privilege escalation confined to the WordPress site. Once the attacker injects code, any visitor to the affected page becomes vulnerable to the script’s effects.