The Bible SuperSearch WordPress plugin contains a stored cross‑site scripting flaw via the selector_height parameter. The flaw exists because the input is not sufficiently sanitized and the output is not properly escaped. An authenticated user with Contributor level or higher can inject malicious JavaScript that executes on every visit to the affected page, potentially enabling defacement, credential theft, or session hijacking.

All versions of the Bible SuperSearch plugin up to and including 6.0.1 released by aicwebtech are impacted. The vulnerability affects any WordPress site that uses this plugin and has users with Contributor or higher privileges, as those roles are required to inject the stored payload.

The CVSS score of 6.4 indicates moderate severity, and an EPSS value below 1% suggests a low probability of exploitation at present. Because the flaw is not listed in CISA KEV, it has not yet been cataloged as a known exploited vulnerability. The attack requires a legitimate contributor account; once the attacker injects the payload, every site visitor that accesses the stored data will run the malicious script, giving the attacker broad impact on that site.