Sitekit, a WordPress plugin by webvitaly, contains a stored cross‑site scripting flaw that allows an attacker to inject malicious JavaScript into the plugin’s output. When the compromised input is loaded by a user’s browser, the script executes with the user’s privileges, enabling session hijacking, defacement, or data exfiltration. The vulnerability is classified as CWE‑79 and can undermine the confidentiality, integrity, and availability of the affected WordPress site.

All installations of Sitekit, version 1.9 and earlier, are affected. The plugin is used on WordPress sites, and any instance running a vulnerable version is at risk. Administrators should verify the plugin version and ensure it is greater than 1.9.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of <1% suggests that real‑world exploitation is expected to be uncommon at this time. The vulnerability is not listed in CISA’s KEV catalog, and there is no known public exploit. Based on the description, it is inferred that an attacker would need to inject malicious input through the Sitekit settings or other input fields, which the plugin then serves unescaped to other users. Once executed, the code runs in the context of the target visitor’s browser, effectively bypassing the plugin’s intended restrictions.