The Ghost Kit plugin for WordPress includes a custom JavaScript field that is not properly sanitized or escaped. As a result, any authenticated user with Contributor-level access or higher can store malicious scripts in this field. When a page containing that field is viewed, the injected scripts execute in the browser of any visitor, enabling a stored cross‑site scripting vulnerability.

All installations of Ghost Kit – Page Builder Blocks, Motion Effects & Extensions on WordPress with versions 3.4.3 and earlier are affected. The plugin provides a custom JavaScript field in page blocks that can be edited by contributors and higher roles. Users with WordPress roles of Contributor or higher can inject the payload.

The CVSS base score of 6.4 indicates a moderate severity vulnerability. The EPSS score is below 1%, signifying a low current exploitation probability. The vulnerability is not present in CISA’s KEV catalog. Because the attack requires authenticated access with Contributor-level permissions, the practical risk depends on the number of users with those roles; if many contributors exist, the likelihood of exploitation increases. Successful exploitation would allow the attacker to run arbitrary scripts in a visitor’s browser.