The Taskbuilder plugin for WordPress suffers from a stored cross‑site scripting flaw whereby an administrator‑level user can inject malicious JavaScript into the ‘Block Emails’ setting. The injected script is rendered in later emails or pages viewed by other users, leading to purely client‑side code execution on those browsers. Because the vulnerability requires authenticated administrator access and is only present when unfiltered_html is disabled on multisite installs, it does not provide remote code execution but can compromise user credentials or enable phishing attacks.

Taskbuilder – Project Management & Task Management Tool With Kanban Board, all versions up to and including 5.0.3. Any WordPress site that has not yet applied the update is affected.

The CVSS score of 4.4 reflects a moderate risk, and an EPSS score below 1% indicates that exploitation is unlikely at this time. It is not listed in the CISA KEV catalog. The attack vector is inferred to be a web‑based interaction with the plugin’s admin interface, where the attacker can edit the block emails setting. Because the defect requires administrator privileges, the scope is limited to users with those roles, but the affected users may suffer session hijacking, credential theft, or phishing if the injected scripts read cookies or forge requests.