The Weaver Show Posts plugin suffers from a stored cross‑site scripting flaw that allows an administrator to embed arbitrary JavaScript into the widget’s additional classes parameter. Because user input is neither sanitized nor escaped, the injected script is rendered and executed whenever a page containing the widget is viewed by any visitor. This vulnerability can be used to hijack user sessions, deface content, or distribute malware. The weakness is a classic cross‑site scripting type flaw.

Any WordPress site running the Weaver Show Posts plugin version 1.8.1 or earlier is affected. The issue is present in all releases up to and including 1.8.1. Multisite installations are particularly vulnerable when site administrators do not have the unfiltered_html capability, because the flaw is triggered by administrators with elevated privileges.

The CVSS v3.1 score of 4.4 indicates moderate risk. Exploit probability details are not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker must first obtain administrator level or higher credentials to inject payloads; once logged in, the stored script can affect all page views of affected sites, potentially compromising confidentiality and integrity for all users.