The Wikilookup plugin for WordPress contains an input sanitization and output escaping failure that allows a malicious administrator to store JavaScript code in the ‘Popup Width’ option. When an affected page is viewed, the injected script runs in the visitor’s browser. Based on the description, it is inferred that such an exploit can be leveraged to gain access to session information, alter the appearance of the site, or redirect users, but the CVE description does not explicitly list these effects.

The vulnerability affects the Wikilookup plugin version 1.1.5 and all earlier releases from the mooeypoo vendor. It operates only on multi‑site WordPress installations that have the unfiltered_html capability disabled; single‑site setups or installations where unfiltered_html remains enabled are not affected.

With a CVSS score of 4.4 the flaw falls into a moderate severity range. No public exploits are known and the EPSS score is not available, which suggests the likelihood of exploitation is low. The required conditions—administrator‑level access on a multi‑site network with unfiltered_html disabled—limit the attack surface, but the potential impact of containing session theft or site defacement means the vulnerability should not be ignored. The likely attack vector is an authenticated administrator modifying the plugin settings to inject malicious code.