The Injection Guard plugin for WordPress is susceptible to Stored Cross-Site Scripting, which allows unauthenticated attackers to execute arbitrary scripts in the context of an administrator session.

The vulnerability exists due to improper input sanitization in the sanitize_ig_data function and a subsequent lack of output escaping in the ig_settings.php template. An unauthenticated attacker can inject malicious JavaScript into query parameter keys, which are then stored and rendered in the plugin's administrative log interface.

Successful exploitation allows an attacker to execute arbitrary web scripts whenever an administrator accesses the Injection Guard log page. This can lead to unauthorized actions within the WordPress dashboard, session hijacking of administrative accounts, or the potential for full site compromise. With a CVSS score of 7.2, this vulnerability represents a high risk to organizational security by leveraging administrative privileges through malicious user input.

Immediate Action: As no patched version is currently confirmed, administrators should immediately deactivate and remove the Injection Guard plugin from all WordPress installations until a vendor-supplied update is available.

Proactive Monitoring: Review administrative access logs for the WordPress dashboard and monitor the plugin settings pages for unusual entries or unexpected script tags stored within the request logs.

Compensating Controls: Implement a Web Application Firewall (WAF) with robust XSS protection rules to filter malicious query parameters before they reach the application layer.

Public Exploit Available: No (exploit_available: unknown).

Given the severity of this Stored XSS vulnerability and the potential for privilege escalation via administrative session compromise, immediate removal of the plugin is the only effective mitigation at this time. Security teams should prioritize this action to prevent potential exploitation of the administrative interface.