The Carta Online plugin for WordPress contains a stored Cross‑Site Scripting flaw that enables an attacker with administrator or higher privileges to inject malicious JavaScript via the plugin's settings page. The injection is stored and rendered on subsequent page loads, allowing the attacker to execute arbitrary client‑side code in the context of all users who view the affected page. Because the code runs with the victim’s privileges, this can be used to steal session cookies, deface sites, or redirect users to phishing sites.

Affected systems are WordPress installations using the Carta Online plugin versions 2.13.0 or earlier. The vulnerability is triggered only when the site operates as part of a multi‑site network or when the WordPress option unfiltered_html is disabled. Any site that has migrated to a newer version or has migrated from a sub‑site to a single site without unfiltered_html disabled is not affected.

The CVSS score of 4.4 indicates moderate risk, and the EPSS score of less than 1% suggests a low exploitation probability under current conditions. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, implying no known public exploit at time of analysis. Attackers must first authenticate with administrator-level roles to reach the vulnerable settings page, so the attack vector is an authenticated web interface. Once injected, the script executes for any user who accesses the affected page, creating a persistent user‑side threat until the plugin is updated or the page content is removed.