The Advanced Views – Display Framework plugin contains a flaw that fails to sanitize and escape user supplied comment content, allowing unauthenticated attackers to store malicious scripts that are executed when visitors load a page containing the comment. This stored XSS can lead to session hijacking, defacement, or theft of client‑side data and is classified as CWE‑79.

Vendors: wplakeorg; Product: Advanced Views – Display Framework – Gutenberg/Elementor/Shortcode. Affected versions are all releases up to and including 3.9.6; the issue is reported to be fixed in later releases such as 3.9.7.

The CVSS score of 7.2 indicates a moderate‑to‑high severity, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is any unauthenticated web user who can insert a crafted comment, as the plugin retrieves comment data without applying an approval filter, meaning the payload runs for any visitor before the comment is moderated. Given the potential impact on user browsers and the lack of requirement for privileged access, the risk is high if the plugin is in use without a patch.