The 12 Step Meeting List WordPress plugin, before version 3.19.17, fails to sanitise and escape data submitted by unauthenticated users before storing it in an activity log. When that log is later rendered in an administrative page, unsanitised input is executed as JavaScript, allowing an attacker to inject arbitrary scripts that run with the privileges of any administrator. This can lead to credential theft, session hijacking, defacement, or further exploitation of the site. The effect is limited to browsers that load the compromised admin page; the attacker cannot directly modify server‑side code but can compromise user sessions and data integrity. The issue is a classic Stored Cross‑Site Scripting flaw, corresponding to CWE‑79, resulting from insufficient input validation for data presented to privileged users.

Vendors/Products: 12 Step Meeting List WordPress plugin. Affected Versions: any release prior to 3.19.17. The vulnerability arises when the geocode event log feature is enabled and accepts unauthenticated submissions.

The CVSS score is 8.8, indicating a high‑severity stored XSS that targets privileged users. Attackers need only send a request to the geocode event log endpoint, which is reachable by unauthenticated traffic. The EPSS score of < 1% signals a very low exploitation probability, yet the impact on administrators—arbitrary script execution—makes the risk significant. The vulnerability is not in the CISA KEV catalog, but the high CVSS and the ability to compromise admin sessions warrant prompt remediation.