Authenticated attackers with author-level access can perform Stored Cross-Site Scripting attacks against the Contextual Related Posts plugin for WordPress, potentially leading to unauthorized script execution.

This vulnerability is a Stored Cross-Site Scripting (CWE-79) flaw occurring within the other_attributes block parameter. It requires an attacker to possess authenticated access at the author level or higher to successfully inject malicious scripts.

Successful exploitation of this vulnerability allows an authenticated attacker to inject arbitrary web scripts into pages. When a victim views the affected page, the malicious script executes in their browser context, which may lead to session hijacking, unauthorized actions performed on behalf of the user, or the exfiltration of sensitive information. While the CVSS score of 6.4 is categorized as medium, the ability to store persistent scripts in a widely used plugin poses a significant risk to administrative integrity.

Immediate Action: Review the official vendor release notes for the latest patched version and update the Contextual Related Posts plugin immediately. If a patch is not yet available, consider disabling the plugin or restricting access to the block editor functionality for untrusted users.

Proactive Monitoring: Monitor WordPress access logs for unusual activity, specifically looking for suspicious POST requests targeting block parameter fields or unexpected script tags being injected into page content.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to inspect and block malicious script injection attempts within plugin parameters.

Public Exploit Available: Unknown

Given the potential for persistent unauthorized script execution, users of the Contextual Related Posts plugin must prioritize applying security updates as soon as they are made available by the vendor. Organizations should audit user permissions to ensure that only trusted individuals hold author-level access, thereby reducing the attack surface for this and similar vulnerabilities.