The Developer Formatter plugin for WordPress contains an insufficient input sanitization and output escaping flaw that lets an authenticated administrator inject arbitrary JavaScript via the Custom CSS feature, resulting in Stored Cross‑Site Scripting that will execute for any user viewing an affected page. This issue falls under CWE‑79 and allows the attacker to compromise the confidentiality, integrity, and availability of the web application for all users of the site.

Vendors and products affected are gsaraiva:Developer Formatter. All releases up to and including version 2015.0.2.1 are vulnerable. The problem is limited to multi‑site installations or those with the unfiltered_html capability turned off, but it applies to every site hosted on those installations.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of <1% signals very low likelihood of general exploitation at the present time. The vulnerability is not listed in the CISA KEV catalogue, suggesting it has not yet been widely exploited. Attackers require administrator access and the ability to add custom CSS, meaning the exploit path involves authenticated access; once accessed, the payload persists across page loads for all users.