The binlayerpress WordPress plugin is vulnerable to stored cross‑site scripting. When an administrator or higher‑privileged user configures certain settings, the plugin fails to sanitize or escape the input and stores the data unfiltered. Any user who subsequently views a page that incorporates those settings will have the malicious scripts executed in the context of the site. Because the vulnerability is stored, it can affect many users over time.

The affected product is the Binlayerpress plugin for WordPress, specifically all releases up to and including version 1.1. The flaw only manifests in multi‑site WordPress installations where the unfiltered_html capability has been disabled. Administrators with elevated privileges in such environments are at risk.

The CVSS score of 4.4 indicates a moderate risk, and the EPSS score of less than 1% suggests that exploitation is unlikely to be widespread at present. The vulnerability is not listed in the CISA KEV catalog, further supporting a lower threat likelihood. However, because any authenticated administrator can inject code, the potential impact includes session hijacking, defacement, or credential theft for site visitors. An attacker would need administrative credentials and access to the site’s backend; once mitigated, the threat is effectively removed.