The Private Comment plugin for WordPress stores the 'Label text' value without sanitizing or escaping user input, allowing an authenticated user with Administrator-level privileges to inject arbitrary JavaScript. When a user opens a page that displays the stored label, the script runs in that user’s browser context. The flaw does not modify server data or files and is limited to affecting client side rendering on the site.

WordPress multi‑site installations running the Private Comment plugin at version 0.0.4 or earlier, where the unfiltered_html capability is disabled for administrators. The plugin is authored by edersonpeka.

The CVSS base score of 4.4 indicates moderate severity. The EPSS score of less than 1 % suggests a very low exploitation probability in the field, and the vulnerability is not present in the CISA KEV catalog. Attack requires Administrator access and a specific multi‑site configuration, limiting the pool of potential attackers; however, any compromised administrator can embed scripts that affect all site users.