The Link Hopper plugin for WordPress contains a stored cross‑site scripting flaw that allows authenticated administrators to inject arbitrary scripts through the hop_name parameter. Supplying a malicious value to hop_name records the script into the database; when another site visitor loads that page the script executes in the visitor's browser. The attacker can hijack sessions, steal credentials, or deface the site. The weakness is a classic input validation and output escaping failure, classified as CWE‑79.

WordPress sites that use the Link Hopper plugin, versions 2.5 and earlier, on multi‑site installations where the unfiltered_html capability has been disabled. Users with administrator privileges on those installations are the only ones who can add or edit hop_name values.

The flaw carries a CVSS score of 4.4, indicating moderate severity. Its EPSS score is below 1% and it is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. However, because the attack requires an administrator role, the risk is confined to sites with high‑privilege accounts. An attacker would need access to the WordPress admin area, create or edit a hop, and then persuade or trick a victim to visit the crafted page. In the absence of mitigation, the compromised page could compromise all subsequent users who view it.