The JSON API User plugin for WordPress contains a stored cross‑site scripting flaw in the post_comment API endpoint. The ‘content’ parameter is passed directly to wp_insert_comment() without sanitization, and the caller can set comment_approved=1 to self‑approve a comment. As a result, any visitor who views a page that retrieves that comment will execute the injected script in their browser, enabling malicious code execution, credential theft, or defacement.

This flaw affects any WordPress site running the parorrey JSON API User plugin on or before version 4.1.0. Users with subscriber or higher role who can call the post_comment API—often enabled in installations that expose comment posting via the API—can inject payloads and trigger the XSS event.

The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of <1%, signifying a very low probability of exploitation in the wild. It does not appear in CISA’s KEV catalog. Based on the description, it is inferred that the API endpoint is publicly accessible to authenticated users with subscriber-level credentials and that setting comment_approved=1 bypasses moderation. Once an approved comment is inserted, the malicious code persists until the comment is removed, making it a persistent stored XSS risk.