The ArtPlacer Widget plugin for WordPress contains a stored cross‑site scripting vulnerability that allows an attacker to inject arbitrary JavaScript into pages served by the site. When a crafted input is saved by the plugin and later rendered, any visitor to the affected page will execute the injected script in their browser. This can lead to defacement, credential theft, or further manipulation of the user session.

The vulnerability exists in all releases of the ArtPlacer Widget plugin from the first public version up to and including 2.23.2. All WordPress sites that have installed any of these plugin versions are potentially affected. The plugin is distributed under the vendor name ArtPlacer Widget.

The CVSS score of 6.5 indicates a moderate severity, and the reported exploitation probability is deemed very low. The vulnerability does not appear in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires the injection of malicious input that is stored by the plugin, typically through an administrative or content‑creation interface. Once stored, the payload is served to any visitor, rendering the attack a client‑side, web‑application‑level vector. Based on the description, the likely attack vector is the plugin’s input fields that accept user‑provided data and display it without proper sanitization.