The Advanced Excerpt WordPress plugin before version 4.5 fails to sanitize one of its configuration settings before rendering it on the front end. An attacker who gains administrator access can inject arbitrary JavaScript into that setting, which will be stored and later executed in the browsers of all visitors to affected pages. The injected script runs in the context of the site, allowing the attacker to steal cookies, deface content, or redirect users to phishing sites. This vulnerability is classified as a stored cross‑site scripting flaw, which undermines the confidentiality and integrity of the user session.

Any WordPress installation that uses the Advanced Excerpt plugin with a version earlier than 4.5 is susceptible. Administrators, even on multisite networks that lack the unfiltered_html capability, can add the malicious payload through the plugin’s settings panel. The problem originates from the plugin itself, not the broader WordPress platform, so any site that has not upgraded the plugin remains at risk.

The absence of a publicly available CVSS or EPSS score means the precise exploitation probability has not been quantified, but stored XSS flaws are widely known to be easily exploitable by individuals with privileged access. The likely attack vector involves an authenticated administrator modifying the ellipsis setting. The vulnerability is not currently listed in the CISA KEV catalog, but its impact warrants immediate remediation. Because the flaw allows arbitrary script execution for any site visitor, the potential damage is significant and the risk of exploitation is high if an attacker gains administrative credentials.