The Amministrazione Trasparente WordPress plugin contains a stored cross‑site scripting flaw that permits an attacker with administrator privileges to insert arbitrary JavaScript into plugin settings. Once injected, the malicious script runs in the browsers of any user who views the affected page, enabling session hijacking, credential theft, or defacement. The weakness is rooted in insufficient input sanitization and the omission of explicit output escaping, which is reflected in CWE‑79. The capability is limited to authenticated users with administrative roles; unauthenticated users cannot trigger it.

Users operating a multi‑site WordPress installation that includes milmor’s Amministrazione Trasparente plugin at version 9.0 or earlier, and where the option unfiltered_html is disabled, are vulnerable. The vulnerability applies only to this plugin and is bounded to the installation mentioned; other plugins or WordPress core are not directly affected.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the near term, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector requires authenticated administrator access; therefore, an attacker must first compromise or compromise credentials for an administrative account. There is no evidence of a public exploit at this time, but the potential for malicious JavaScript rendering raises user‑level risk if compromise occurs.