Contributor Cross Site Scripting in Ghost Kit <= 3.6.0 allows an attacker who can add or edit content to insert malicious JavaScript. This injected code is rendered in the browsers of any visitors who view that content, creating a client‑side attack surface.

The vulnerability affects the Ghost Kit plugin used within WordPress sites. All installations using version 3.6.0 or earlier are impacted; newer releases contain a fix. Sites that deploy Ghost Kit on a WordPress installation are the primary target group.

The CVSS base score of 6.5 reflects a moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, indicating no confirmed, widespread exploitation to date. The likely attack vector involves a contributor or user with the ability to add or edit plugin content; an attacker would create a malicious payload that is then rendered in the browsers of other site visitors. While it does not grant remote code execution on the server, it enables client‑side script execution.