The TP2WP Importer plugin for WordPress is vulnerable to stored cross‑site scripting via the ‘Watched domains’ textarea on the attachment importer settings page. The flaw originates from missing input sanitization and output escaping when user‑supplied domains are saved via AJAX and later rendered with echo implode() without the appropriate esc_textarea() call. This allows an attacker with Administrator‑level privileges to inject arbitrary JavaScript, which will execute for anyone who navigates to the settings page. The impact is that compromised administrators can alter page content, steal credentials or redirect users, enabling further exploitation. The weakness corresponds to CWE‑79.

The affected product is the TP2WP Importer plugin from readymadeweb. All released versions up to and including 1.1 are vulnerable; any site running the plugin on those versions is at risk.

The CVSS score of 4.4 indicates a moderate severity. The EPSS score of less than 1% reflects a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires the attacker to have authenticated access with Administrator‑level or higher privileges. Once authenticated, the attacker can persist malicious script in a textarea that will run in the browser of any user who views the settings page, potentially leading to credential compromise or defacement.