The kontur Admin Style WordPress plugin contains a stored XSS flaw caused by incorrect input neutralization. An attacker who can inject content into the plugin can store malicious JavaScript that is executed whenever a site visitor loads the affected page. This can lead to session hijacking, credential theft, defacement, or the execution of arbitrary scripts within the site‑admin context. The weakness aligns with CWE‑79: Improper Neutralization of Input During HTML Generation.

WordPress sites that have the kontur Admin Style plugin version 1.0.4 or earlier installed. The plugin is distributed by kontur.us and is referenced in the WordPress plug‑in repository. Any site running the affected versions is potentially vulnerable until the plugin is updated or removed.

The CVSS score of 5.9 indicates medium severity, while the EPSS score of < 1% suggests that active exploitation is unlikely at present. The vulnerability is not listed in CISA KEV. The attack requires the ability to inject data via the plugin, typically achievable by an account with content‑editing privileges or an administrator. Because the payload is stored, even a single successful injection provides persistent access to all subsequent page views until the content is purged or the plugin is updated.