The Allow HTML in Category Descriptions plugin is vulnerable to stored cross‑site scripting. By removing the wp_kses_data filter for term_description, link_description, link_notes, and user_description fields without validating user capabilities, an attacker with administrator‑level or higher privileges can embed malicious scripts into category descriptions. Those scripts execute whenever the category description is displayed to any visitor, potentially enabling data theft, defacement, or malware delivery. This flaw corresponds to CWE‑79.

The vulnerability affects all releases of the Allow HTML in Category Descriptions plugin up to and including version 1.2.4, as used on WordPress multi‑site installations or any site where unfiltered_html is disabled. The plugin is produced by arnoesterhuizen. Only administrators or higher roles can exploit the flaw; non‑administrator users cannot inject code directly. The impact is confined to category descriptions, which are displayed on pages where a category is shown.

The CVSS base score of 4.4 indicates moderate severity, while an EPSS score of less than 1% reflects a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalogue, implying no known large‑scale exploitation as of now. The attack vector requires authenticated admin access on a site that renders category descriptions; once code is injected, it runs for all visitors, amplifying the potential impact. Consequently, organizations using this plugin should treat the flaw as a significant risk that warrants timely remediation.