The Extended Random Number Generator plugin for WordPress contains a stored cross‑site scripting vulnerability in all releases up to 1.1. Inadequate input sanitization and output escaping in the plugin settings page allows an authenticated user with administrator privileges to inject malicious JavaScript that is stored in the database. When a page that includes that setting is rendered, the injected script executes in the browsers of any visitor, potentially stealing session cookies, defacing content, or bypassing authentication.

The vulnerability affects installations of the rtddev:Extended Random Number Generator plugin on WordPress multisite networks or single‑site deployments where the unfiltered_html capability is disabled. The flaw exists in every version from the initial release through 1.1 inclusive, so any user running that version should consider updating. Other WordPress plugins or core components are not directly impacted.

With a CVSS v3.1 score of 4.4, the risk is classified as moderate, but the EPSS score is below 1 % and the issue is not listed in CISA’s KEV catalog, indicating a very low probability of public exploitation at present. Successful exploitation requires that the attacker already possesses administrator access and that the target is a multisite configuration with unfiltered_html turned off. Because the flaw is stored, the abuse potential remains as long as the malicious script persists in the settings, so the impact could persist for all users who view affected pages.