The Contextual Related Posts plugin for WordPress is vulnerable to a stored cross‑site scripting flaw triggered via the 'other_attributes' block parameter. Insufficient input validation and output escaping allow an attacker with author‑level access or higher to embed arbitrary JavaScript that is executed whenever a page containing the block is rendered, constituting a classic stored XSS (CWE‑79).

Any WordPress site that runs the Contextual Related Posts plugin version 4.4.1 or earlier is affected. The plugin is developed by ajay and the flaw is present across all supported releases up to and including 4.4.1. Sites that grant author or higher roles to users are at risk because the injected scripts will run in the browsers of all visitors who load the affected page.

The CVSS score of 6.4 indicates a medium severity. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available. Exploitation requires authentication at the author level or higher, which is common in many WordPress installations. The vulnerability stores malicious scripts in the database and executes them on every page load that includes the vulnerable block, affecting all site visitors who view the page.