The vulnerability allows a stored XSS attack through the carticon_js_script parameter in WP Carticon. An authenticated user with administrator privileges can inject arbitrary JavaScript that will run whenever another user views the page. This can lead to session hijacking, defacement or execution of malicious code in the context of the victim's browser session.

WordPress multisite installations running WP Carticon plugin version 1.0.0 or earlier where the unfiltered_html capability is disabled. Only sites that use the carticon_js_script setting are impacted.

The CVSS score of 4.4 indicates a moderate impact. The EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires administrator clearance and an active WordPress multisite environment, making it a niche threat with limited scope.