The Smart Manager WordPress plugin fails to properly encode a post title before rendering it into an HTML attribute in its management grid. This flaw allows users with the Contributor role or higher to store malicious JavaScript that executes in the browser session of any administrator who views the grid. The stored XSS can be used to hijack administrator sessions, steal cookies, or perform other client‑side malicious actions. The weakness arises from missing output sanitization before inclusion in an HTML attribute, a classic stored XSS scenario.

The vulnerability is present in versions of the Smart Manager plugin earlier than 8.92.0, which is distributed by an undisclosed vendor listed as Unknown:Smart Manager. It affects any WordPress site that uses the plugin’s post management grid and allows users with Contributor or higher roles to create or edit post titles.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of 0.00142 indicates a very low exploitation probability, less than 1%. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker with Contributor privileges submitting a crafted post title through the WordPress interface; the malicious script is stored and later executed when an administrator views the grid. Because the code runs with the administrator’s privileges, the impact can be severe if the attacker abuses that session.