The Companion Auto Update plugin contains a stored cross‑site scripting flaw that lets an authenticated user with administrator privileges modify the update_delay_days option. The value entered is stored without sanitization and later rendered in administrative pages without proper output escaping. As a result, a malicious administrator can inject JavaScript that will execute in the browsers of any user who views the affected page. This can lead to arbitrary script execution within the context of the site.

All installations running Companion Auto Update version 3.9.2 or earlier on a WordPress multisite network where the unfiltered_html capability has been disabled are affected. The vulnerability is limited to the plugin and does not affect other WordPress core components.

The CVSS base score of 5.5 indicates a moderate risk level. The EPSS score of less than 1 % suggests that exploitation attempts are rare at present. The flaw is not included in CISA’s KEV catalog. Exploitation requires an attacker to authenticate as an administrator on a multisite WordPress installation with unfiltered_html disabled and then edit the update_delay_days setting. Because the malicious payload is stored, the compromised script will run whenever any user accesses a page that outputs the stored value.