The Content Views plugin is vulnerable to stored cross‑site scripting via its Grid and List widgets because user supplied attributes are not properly sanitized and output escaped. An attacker with contributor-level or higher access can inject arbitrary JavaScript that will run in the context of any user who views an affected page. This enables theft of session cookies, defacement, or the execution of further malicious actions on behalf of the victim.

WordPress sites utilizing the Content Views – Post Grid & Filter, Recent Posts, Category Posts, and related shortcode features, Gutenberg blocks, or Elementor widgets. All plugin versions up to and including 4.1 are impacted.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated attacker privileges of contributor level or higher. The flaw is stored and will affect every site visitor who loads a page containing the injected widget code.