The BE REST Endpoints plugin for WordPress allows widget data to be read, created, updated, or deleted without any authorization checks. Input values stored in widgets are not sanitized, allowing an attacker to insert arbitrary JavaScript that will run in the browsers of any site visitor. This results in a stored cross‑site scripting vulnerability that can be used for session hijacking, credential theft, defacement, or other malicious client‑side attacks.

Any WordPress installation with the BE REST Endpoints plugin version 1.0.0 or earlier is affected. The flaw applies to all user roles because the plugin accepts unauthenticated requests to widget‑related endpoints.

The CVSS score of 8.8 indicates high severity, though the EPSS score is <1% suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. From the description, an attacker can exploit the flaw by sending crafted REST API requests that insert malicious scripts into widget content. The lack of authentication checks makes the attack vector attainable from any IP address, but the actual impact is limited to client‑side execution in the victim’s browser.