The FastBots WordPress plugin fails to properly sanitize or escape input in its administration settings, allowing an authenticated user with administrator level permission or higher to store arbitrary JavaScript code. When an affected page is viewed, the injected script executes in the victim’s browser, enabling defacement, credential theft, or other client‑side attacks. This flaw arises from insufficient input handling, representing a classic stored cross‑site scripting weakness (CWE‑79).

All releases of the FastBots plugin up to and including version 1.0.12 are vulnerable on WordPress installations that are multi‑site and have the unfiltered_html feature disabled. The impact is confined to setups where the plugin’s settings page can be modified by administrators or higher roles.

The CVSS score of 4.4 indicates a moderate severity. Exploitation requires an attacker to be authenticated as an administrator or higher; without such privileges the flaw cannot be leveraged. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, suggesting that widespread exploitation is unlikely at present, though the risk remains for installations that have local admin access and the vulnerable plugin version.