The WP Nano AD plugin for WordPress contains a flaw that allows a stored cross‑site scripting attack when an administrator supplies data to the blogrole_link parameter. By injecting malicious scripts into this field, an attacker can insert code that will run in the browsers of any user who views the affected page, potentially leading to session hijacking or data theft. The weakness is a classic input validation flaw and is documented as CWE‑79.

This vulnerability affects installations of the WP Nano AD plugin authored by ariyes, specifically all releases up to and including version 1.31. The impact is limited to multi‑site WordPress deployments where the unfiltered_html capability has been disabled, as those configurations allow the stored content to be rendered without further sanitization.

The CVSS score of 5.5 indicates moderate severity. Because the exploit requires authenticated access with administrator privileges, the attack vector is local and relies on the existence of an admin account. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that no widespread exploitation has been reported. Nevertheless, any organization that uses the affected plugin in a multi‑site setting should consider the risk high if administrator accounts exist and unfiltered_html is turned off.