The vulnerability allows injection of arbitrary scripts into the Fleet Manager configuration pages. When an authenticated user with editor or higher privileges modifies the settings, the input is stored without proper sanitization or escaping, and will be rendered on subsequent page loads. This results in client‑side code executing in the context of any user who views the affected page, potentially exposing session data, cookies, or enabling defacement.

WordPress installations using the iWorks Fleet Manager plugin, versions 2.5.1 and earlier, on multi‑site networks where the unfiltered_html capability is disabled. Sites with single‑site setups are not impacted.

The CVSS score of 4.4 indicates moderate severity. An attacker must first authenticate with editor or higher permissions, which limits the potential exploit pool. The EPSS score of less than 1% reflects a low likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. The attack vector can be inferred as an authenticated administrative intrusion; the resulting XSS would be browser‑side and cannot execute server‑side commands.