Advanced Excerpt
Monthly
Stored XSS in the Advanced Excerpt WordPress plugin before 4.5 permits administrators - critically including those without the `unfiltered_html` capability, such as site-level admins in WordPress multisite deployments - to inject persistent JavaScript payloads via unsanitized plugin settings, which then execute silently in every visitor's browser on affected pages. A publicly available proof-of-concept exists per WPScan's disclosure (EUVD-2026-55021), though EPSS remains very low at 0.16% (6th percentile) and the vulnerability is not confirmed in CISA KEV. The primary risk surface is WordPress multisite environments, where this plugin's settings bypass the platform-level capability restriction that normally prevents restricted admins from injecting raw HTML.
Stored XSS in the Advanced Excerpt WordPress plugin before 4.5 permits administrators - critically including those without the `unfiltered_html` capability, such as site-level admins in WordPress multisite deployments - to inject persistent JavaScript payloads via unsanitized plugin settings, which then execute silently in every visitor's browser on affected pages. A publicly available proof-of-concept exists per WPScan's disclosure (EUVD-2026-55021), though EPSS remains very low at 0.16% (6th percentile) and the vulnerability is not confirmed in CISA KEV. The primary risk surface is WordPress multisite environments, where this plugin's settings bypass the platform-level capability restriction that normally prevents restricted admins from injecting raw HTML.