The vulnerability is a stored cross‑site scripting flaw in the Netroics Blog Posts Grid plugin for WordPress. Because the post_title parameter is not properly sanitized, an editor can embed arbitrary JavaScript into the testimonial title field. When other authenticated users access the affected draft post, the injected script runs in their browsers, permitting cookie theft and session hijacking.

This issue affects the Netroics Blog Posts Grid WordPress plugin version 1.0 installed on any WordPress site. Administrators should verify whether this plugin is active and if the installed version is 1.0, as that version contains the unpatched flaw.

The CVSS score of 5.1 indicates a moderate severity, and because the EPSS score is not available and the vulnerability is not in the KEV catalogue, the anticipated exploitation likelihood is uncertain. However, the flaw requires only editor‑level permissions, which are commonly granted on many sites, making the attack vector relatively low‑barrier for an internal attacker. An attacker could use the stored XSS to steal session cookies, leading to account takeover of other site users.