Stored Cross‑Site Scripting is possible when an authenticated user having Contributor or higher privileges submits an entry containing malicious JavaScript in the width parameter. The input is not sanitized and is later rendered back to the browser unescaped. When any user views the affected page, the injected script runs with that user’s browser context, allowing the attacker to steal session cookies, perform phishing, or further compromise the site.

The vulnerability is found in the Fan Page WordPress plugin made by delower186. All released versions up to and including 1.0.1 are affected. Any WordPress site that has this plugin installed and permits Contributor role access is potentially exploitable.

With a CVSS base score of 6.4 the flaw is considered medium severity. The EPSS score of less than 1 % indicates that large‑scale exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV. Attack requires a valid WordPress account with Contributor‑level rights or higher and the ability to create or edit a page that renders the width field. Upon successful injection an attacker can run arbitrary client‑side code whenever a visitor loads the compromised page.