The BWL Advanced FAQ Manager Lite WordPress plugin contains a stored cross‑site scripting flaw. The plugin’s shortcode processes several user‑supplied attributes—including sbox_id, sbox_class, placeholder, highlight_color, highlight_bg, and cont_ext_class—without applying proper sanitization or escaping, allowing an authenticated user with Contributor-level or higher privilege to inject malicious JavaScript. The injected script is stored and subsequently executed whenever a page containing the shortcode is rendered, enabling the attacker to deface the site, exfiltrate session data, or perform other client‑side attacks.

WordPress installations running BWL Advanced FAQ Manager Lite version 1.1.1 or earlier, distributed by xenioushk. Any site that embeds the affected shortcode on publicly accessible pages is vulnerable.

The flaw carries a CVSS score of 6.4, indicating moderate severity. No exploitation probability score is currently available, and the vulnerability is not included in the known exploited vulnerabilities catalog. Exploit requires an attacker to first obtain Contributor or higher level access to the WordPress site and then to inject malicious content via the shortcode attributes. Once stored, the payload is delivered to all users who view the affected page, making the compromise possible even to non‑authenticated visitors. The combination of authentication requirement and persistent injection provides a tangible but bounded risk to affected sites.