The Short Comment Filter plugin for WordPress, versions up to 2.2, suffers from a stored cross‑site scripting vulnerability (CWE‑79) in the 'Minimum Count' settings field. The plugin registers the option without a sanitize callback, and the value is echoed inside an HTML attribute without escaping. An authenticated administrator can enter arbitrary JavaScript, which will be executed whenever the settings page is loaded by any user, potentially compromising the entire blog.

This flaw affects all WordPress installations running itsananderson's Short Comment Filter plugin with a version 2.2 or earlier. The issue is especially relevant for multisite networks or where the DISALLOW_UNFILTERED_HTML constant is set, because administrators normally lack the unfiltered_html capability yet still can inject code via the settings page.

The CVSS score of 4.4 denotes moderate risk. Exploitation requires valid administrator credentials, but the injected payload is stored indefinitely and will run for every visitor of the settings page, including other admins. With no EPSS data and absence from the CISA KEV catalog, widespread exploitation is currently unreported, but the persistence of the payload makes it a significant concern in shared admin environments.