The Contextual Related Posts plugin contains a stored cross‑site scripting flaw that allows an authenticated user with contributor or higher privileges to inject malicious JavaScript into the "other_attributes" field. Once a script is stored, it executes automatically whenever any user opens a page that displays the injected data, enabling session hijacking, defacement, or data exfiltration. The vulnerability is a classic case of insufficient input sanitization and output escaping, as identified by CWE‑79.

This issue affects the WordPress plugin Contextual Related Posts up to and including version 4.2.1. Sites that have installed any of those versions and have users with contributor or elevated roles are impacted. No other WordPress core components or plugins are listed as affected.

The CVSS score of 6.4 suggests a moderate level of risk, and the EPSS score is not available, so exploitation likelihood cannot be quantified precisely. The vulnerability is not listed in CISA KEV, indicating no known broad exploitation at the time of reporting. Attackers can exploit the flaw locally by creating or modifying entries within the plugin. The stored nature of the payload means that once injected, the script runs for all visitors, providing a broad impact for the site owner.