The Vulnerability is a stored XSS flaw in the Narrative Publisher WordPress plugin. The plugin exposes a REST‑based endpoint that allows users with contributor or higher roles to write directly to a post meta field named 'narrative_post_script' without validation or escaping. Malicious JavaScript stored in this field is then rendered when a higher‑privileged user views the affected post, leading to cross‑site scripting that can compromise the attacker’s session, steal cookies, or execute arbitrary actions in the victim’s browser. The flaw affects only WordPress sites running the plugin version 1.0.7 or older, and requires that an attacker has a role of at least contributor to inject the payload, but the impact is felt by administrators, editors and any privileged user who accesses the post. The weakness is primarily a classic cross‑site scripting vulnerability (CWE‑79).

WordPress sites that have the Narrative Publisher plugin installed, version 1.0.7 or earlier. The plugin is listed by an unknown vendor; any WordPress installation that includes 'Narrative Publisher' is potentially impacted. No other products are listed as affected. The plugin is typically loaded in the WordPress admin area and integrates with the REST API for post meta handling.

The exploit path requires an attacker to first acquire contributor or higher privileges on the affected site. From there, they can send a crafted REST request to write arbitrary JavaScript to the 'narrative_post_script' meta field. Once saved, the code is executed automatically whenever any privileged user opens the edited post. The CVSS score of 4.6 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of real‑world exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. However, because the flaw is a stored XSS that affects higher‑privileged viewers, the potential damage is significant: credential compromise, defacement, or execution of additional malicious actions. The primary attack vector is via the exposed REST endpoint, and the remedy is to apply a patch that validates and escapes the meta value before rendering.