This vulnerability allows an authenticated user to inject arbitrary JavaScript via the URL field in the Frontend Settings of the IP2Location Country Blocker plugin. Upon visiting the plugin settings page, the malicious script runs with the privileges of the logged‑in user, potentially enabling session hijacking, credential theft, or defacement. The weakness is a classic stored XSS flaw classified as CWE‑79.

The issue affects WordPress sites running IP2Location Country Blocker version 2.26.7. Only this specific version is confirmed to be vulnerable; other versions of any IP2Location products are not known to be impacted.

With a CVSS score of 5.1 the vulnerability is moderate. Exploitation requires only that the attacker has authenticated access and can edit the plugin settings, so a user with any role that can access this interface can abuse it. EPSS data is not available and the flaw is not listed in CISA KEV. Because the script executes in the context of a visiting administrator, the risk to site ownership or to end users is significant for any compromised plugin account.