A stored cross-site scripting flaw exists in the Hostinger Reach WordPress plugin before version 1.8.3. The plugin fails to sanitize a widget setting that is then output in the editor preview, allowing a contributor or more privileged user to inject arbitrary JavaScript. When a higher‑privileged user opens the affected content in the editor, the injected scripts run in that user's session, potentially enabling credential theft, session hijacking, or defacement of the site. The weakness is a classic stored XSS (CWE‑79).

The vulnerability affects installations of the Hostinger Reach WordPress plugin with versions prior to 1.8.3, as shipped for all WordPress users of the Hostinger Reach distribution. No specific minor versions other than the upper bound are listed; any version up to 1.8.2 is impacted.

The severity of the vulnerability is quantified by a CVSS score of 6.8, with an EPSS score of less than 1 % indicating a very low but nonzero likelihood of exploitation, and it is not listed in the CISA KEV catalog. The vulnerability is functional only when a user with contributor-level access or higher creates or edits a widget that contains the problematic formId attribute. An attacker must first gain contributor privileges or compromise a legitimate contributor account. Once the injection is present, any higher‑privileged user who opens the editor for that content will be impacted. While the exploitation method is straightforward, the actual risk remains high due to the potential impact on higher‑privileged accounts and the relative ease of deploying the attack via the editor interface.