The WP Latest Posts plugin contains a stored cross‑site scripting flaw that occurs when an authenticated user with author‑level access posts content that includes an <img> tag whose src attribute has been crafted to contain malicious JavaScript. The plugin’s parsing logic extracts the src value with a regular expression and then re‑creates the <img> element without applying WordPress’s standard sanitization, allowing the injected script to execute in the browsers of any visitor who views the post.

Affected systems are sites running the joomunited WP Latest Posts plugin in any version up to and including 5.0.11. Administrators should verify that the plugin version is 5.0.12 or newer.

With a CVSS score of 6.4, the risk is moderate, and the EPSS score is not available, while the vulnerability is not listed in CISA’s KEV catalog. Successful exploitation requires author‑level credentials; an attacker can embed arbitrary scripts that will run in the browsers of any user who encounters the compromised post, potentially leading to phishing, credential theft, or further session hijacking.