The FuseDesk plugin for WordPress contains a stored XSS flaw that allows authenticated users with Contributor or higher privileges to inject JavaScript via the successredirect parameter. The input is neither cleaned nor escaped, meaning that the attacker can embed scripts that will run when any user views a page containing the malicious redirect. This vulnerability can be used to steal session cookies, deface content, or perform phishing attacks by executing arbitrary code in the victim's browser. The weakness aligns with CWE‑79, which describes malicious input delivered inline.

Affected products are all releases of the FuseDesk WordPress plugin up to and including version 6.7, developed by Jeremy Shapiro. Users running any of these versions, regardless of PHP version or host environment, are at risk. The bug exists in the plugin's core PHP file handling successredirect, and therefore any site that has the plugin installed and allows contributor-level edits can be compromised.

The CVSS base score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests low probability of exploitation in the wild. It is not yet listed in the CISA KEV catalog. Exploitation requires having authenticated access at the Contributor level or higher within the WordPress site, then submitting a crafted successredirect value through the plugin's settings. Because the input is stored, the malicious code persists until the setting is removed or the plugin is upgraded. Attackers could use the injected scripts to perform social engineering or steal data from unsuspecting users.