The Stock Ticker plugin for WordPress is vulnerable to a stored cross‑site scripting flaw in all releases up to and including 3.26.1. Insufficient input sanitization and improper output escaping in the plugin’s administrative settings allow an attacker who has administrator‑level credentials to inject arbitrary JavaScript code that executes for any user who visits a page that renders the injected content. This could be used to deface the site, steal user credentials, or redirect traffic. The weakness is classified as CWE‑79.

This issue affects installations of the Stock Ticker plugin by urkekg on WordPress multisite sites where the unfiltered_html option is disabled. Only versions up to 3.26.1 are impacted; newer releases are not affected and provide a clean fix. The vulnerability applies to administrators or users with elevated privileges who can modify the plugin’s settings.

The CVSS score of 4.8 places the flaw in the ‘moderate’ severity range. The EPSS score is reported as less than 1 %, indicating a very low probability of exploitation in the wild; the flaw is also not included in the CISA KEV catalog. Attackers would need authenticated administrator access and would be limited to exploiting stored scripts in the plugin’s configuration. While the risk to confidentiality, integrity, and availability is moderate, failure to patch could allow widespread client‑side attacks across a multisite network.