The WP Allowed Hosts plugin for WordPress exhibits a stored cross‑site scripting vulnerability in the 'allowed-hosts' parameter. Because the input is not properly sanitized or escaped, an authenticated user with administrator privileges can embed arbitrary JavaScript into the list of allowed hosts. When a site visitor accesses a page that includes the injected host value, the script will execute in the visitor’s browser.

This flaw is limited to WordPress multisite installations that use WP Allowed Hosts version 1.0.8 or earlier and have the 'unfiltered_html' capability disabled. Only these configurations allow the vulnerable code path to be exploited.

The vulnerability receives a CVSS score of 4.4, reflecting moderate severity, and the EPSS probability is reported as less than 1%, indicating a low likelihood of widespread exploitation. It is not listed in the CISA KEV catalog. An attacker must be authenticated with administrator rights and can exploit the flaw through the normal plugin configuration interface, making the attack vector remote and authenticated.