The Private WP suite plugin contains a stored cross‑site scripting flaw in the Exceptions setting caused by insufficient input sanitization and output escaping. An attacker who can log in with Administrator level or higher privileges can inject malicious scripts that will run whenever a user views an affected page. These injected scripts execute in the victim’s browser when the page is viewed. This weakness is listed as CWE‑79.

Vendor: Private WP suite. Product: Private WP suite plugin for WordPress. All released versions up to and including 0.4.1 are affected. The vulnerability is only present in multi‑site WordPress installations where the unfiltered_html capability is disabled.

The CVSS score of 4.4 indicates a moderate risk level. No EPSS score is available, so the current exploitation probability is unknown. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires authenticated Administrator‑level access and the presence of the multi‑site configuration, implying a higher potential impact on sites with broader administrative scopes. Once a legitimate administrator injects the script, it will be delivered to all users accessing the affected page, making it a serious threat for environments where users browse the site frequently.