The XX2WP Integration Tools plugin for WordPress allows stored XSS because the ‘mxp_fb2wp_display_embed’ shortcode does not sanitize the user‑supplied ‘post_id’ parameter, a flaw identified as CWE‑79. Attackers who can authenticate as a contributor or higher can insert arbitrary scripts that will execute when any user loads the affected page, potentially stealing credentials or defacing content. The CVSS score of 6.4 reflects the severity of this worst‑case scenario.

All installations of the XX2WP Integration Tools plugin with a version of 1.9.9 or earlier are affected. The vulnerability is specific to the WordPress plugin identified by the CNA as mxp:XX2WP Integration Tools.

The EPSS score is less than 1 %, indicating a low but non‑zero probability that the flaw will be targeted. The issue is not listed in CISA’s KEV catalog. Because the impact requires an authenticated user with at least contributor access, an attacker must first gain or use legitimate WordPress credentials. Once the payload is stored, the cross‑site scripting effect will occur for any other visitor, exposing the site to data theft or session hijacking.