Viet Contact, a WordPress plugin, contains a stored cross‑site scripting flaw limited to its administrative settings. The bug allows administrators or higher‑privileged users to place arbitrary scripts via the ll1‑ll4 parameters, because the plugin does not properly sanitize or escape output. The injected script is stored and executed whenever a user views the compromised page, enabling malicious payloads such as credential theft or defacement.

WordPress plugin Viet Contact, versions 1.3.2 and earlier, is affected. The vulnerability is exposed only in multisite installations that have the unfiltered_html capability disabled.

With a CVSS base score of 4.4 the technical severity is low, but the EPSS score is below 1 % and the flaw is not listed in CISA’s KEV catalog, suggesting low exploitation likelihood in the wild. Nonetheless, because the vulnerability grants stored script injection that runs for all page visitors, an attacker who has administrative credentials could hijack sessions, spy on users, or alter content. The attack vector is inferred to require authenticated administrative access and the presence of the plugin’s configurable fields.