The Advanced Excerpt WordPress plugin before version 4.5 fails to sanitize one of its configuration settings before rendering it on the front end. An attacker who gains administrator access can inject arbitrary JavaScript into that setting, which will be stored and later executed in the browsers of all visitors to affected pages. The injected script runs in the context of the site, and may alter the visitor’s experience or disrupt site content. This vulnerability is classified as a stored cross‑site scripting flaw, which undermines the integrity of the front‑end output.

Any WordPress installation that uses the Advanced Excerpt plugin with a version earlier than 4.5 is susceptible. Administrators, even on multisite networks that lack the unfiltered_html capability, can add the malicious payload through the plugin’s settings panel. The problem originates from the plugin itself, not the broader WordPress platform, so any site that has not upgraded the plugin remains at risk.

The CVSS score of 4.8 indicates moderate severity, while the EPSS score of <1 % suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated administrator who modifies the ellipsis setting, enabling the malicious script to be stored and subsequently executed for all site visitors. Because the issue is tied to administrative actions, the direct damage can be significant if the stored script includes destructive or deceptive payloads.