The Buzz Comments plugin for WordPress suffers from insufficient input sanitization and output escaping in the Custom Buzz Avatar setting, allowing an authenticated attacker with administrator privileges to store malicious JavaScript that will execute in any user’s browser when the plugin settings page is visited. This stored cross‑site scripting flaw can compromise the integrity of the site’s displayed content. The weakness corresponds to CWE‑79.

All installations of the Buzz Comments plugin from mixer2 running versions up to and including 0.9.4 are vulnerable. The plugin is a WordPress add‑on and affects WordPress sites that have it installed.

The CVSS base score of 4.4 indicates moderate severity. Because the vulnerability requires authenticated administrator access, the attack surface is limited to users with that role. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating it is not a currently known exploited vulnerability. However, the stored XSS nature means that once injected, the malicious script persists until removed, potentially affecting all users who view the plugin settings page.