The 12 Step Meeting List WordPress plugin contains a high-severity stored cross-site scripting vulnerability that allows unauthenticated attackers to execute malicious scripts in an administrator's browser session.

This is a Stored Cross-Site Scripting (CWE-79) vulnerability where unauthenticated users can inject malicious payloads into the plugin activity log. The payload executes when an administrator views the log within the WordPress dashboard.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of an administrator session. This could lead to full site compromise, unauthorized administrative actions, or the creation of rogue administrator accounts, severely impacting business operations and data integrity. The CVSS score of 8.8 reflects the high potential for impact on confidentiality, integrity, and availability.

Immediate Action: Update the 12 Step Meeting List plugin to version 3.19.17 or later to ensure proper input sanitization.

Proactive Monitoring: Review administrative audit logs for unusual activity or unauthorized configuration changes that may indicate a compromised session.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common XSS patterns and malicious script injections targeting the WordPress administration interface.

Public Exploit Available: No

Given the potential for administrative account takeover, this vulnerability poses a significant risk to site security. Administrators should prioritize updating the 12 Step Meeting List plugin immediately to the fixed version to prevent potential exploitation of this cross-site scripting flaw.