The Hester Core WordPress plugin versions 1.1.8 and earlier include a cross‑site scripting vulnerability that permits an attacker to inject arbitrary JavaScript into web pages served by the plugin. This flaw, classified as CWE‑79, can lead to session hijacking, defacement, or the execution of malicious code in the victim's browser, thereby compromising confidentiality and integrity of the site and its users.

The vulnerability affects the PeregrineThemes Hester Core plugin for WordPress. Any installation using version 1.1.8 or earlier is susceptible; later releases, such as 1.1.9 and above, contain the fix.

The CVSS score of 5.9 indicates a medium risk. EPSS is unavailable, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is through input or configuration fields that the plugin renders without proper escaping. Successful exploitation would require an attacker to persuade a user to view a page containing the injected script, typically by leveraging an administrative or content‑creation role within the WordPress installation.