The StageShow plugin for WordPress allows an authenticated Contributor or higher to persist malicious JavaScript by sending arbitrary code through the anchor parameter. The server stores the data without sufficient input sanitization or output escaping, resulting in stored cross‑site scripting. An attacker can then trick users who view the affected page to run the script in their browser, potentially hijacking sessions, modifying content, or delivering malware. This flaw aligns with CWE‑79.

The vulnerability exists in all releases of the StageShow plugin up to and including version 10.0.3. The affected product is the StageShow WordPress plugin published by the StageShow Project. The plugin is available on the WordPress Plugin Directory and can be installed by site administrators on any WordPress installation that uses this plugin.

The CVSS score of 6.4 marks the issue as medium severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation at this time. The flaw is not listed in the CISA KEV catalog. Because an attacker must be authenticated, the attack vector requires at least Contributor privileges, which limits exposure to sites with up‑to‑date role assignments. Nonetheless, any site that accepts Contributor users remains vulnerable until the plugin is updated or the flaw is mitigated.