The plugin suffers from a stored cross‑site scripting flaw that allows authenticated WordPress users, including those with subscriber privileges or higher, to inject arbitrary JavaScript into theme files via the unconstrained ‘js’ parameter. The vulnerability arises because the themeFunc() function processes theme update requests without validating the user’s capability and the input is not sanitized or encoded. As a result, a malicious script saved by an attacker will execute whenever a page that includes the diagnosis form shortcode is rendered, potentially compromising the sessions of all visitors and allowing data theft or further attacks. The code also removes WordPress’s magic quotes protection by using stripslashes(), further enabling the persistence of injected payloads.

Version 1.4.16 or earlier of the Diagnosis Generator plugin supplied by olivesystem. The plugin is a WordPress add‑on; the affected component is the theme functionality that accepts the ‘js’ parameter during an update operation. No other versions or product variants are listed as affected.

The CVSS score of 6.4 indicates a moderate severity. EPSS data is unavailable, and the exploit is not listed in CISA’s KEV catalog. The attack vector is authenticated; an attacker only needs to log in as a subscriber or higher to persist malicious script code. If the site’s role hierarchy allows subscribers to update themes, the vulnerability is fully exploitable. An adversary could then coerce other site visitors into executing the script, enabling cross‑site request forgery, session hijacking, or defacement. Because the flaw is stored, the impact persists across sessions until the payload is removed or the plugin is upgraded.