The Color Palette plugin for WordPress stores color values supplied via a hex parameter without proper sanitization or escaping. Authenticated users who hold at least Contributor permissions can inject arbitrary JavaScript into this field. Because the content is persisted in the database and rendered on every page load that includes the color palette block, each visitor to the affected page will execute the injected script. This can lead to cookie theft, session hijacking, or page defacement. The vulnerability is a classic stored XSS, classified as CWE‑79, and carries a CVSS score of 6.4.

The vulnerability affects the Color Palette plugin authored by thatdevgirl. All releases up to and including version 4.3.2 are vulnerable. No fixed version information is provided in the current data; vendors or maintainers have not indicated a specific release that resolves the issue.

The EPSS score of less than 1 % indicates that large‑scale exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate with Contributor or higher access, which limits the attack surface to users who can add or edit color palettes. However, once a payload is stored, it will run for every user who views a page containing the color palette block, potentially exposing a wide audience to the injected code.