The vulnerability is a stored cross‑site scripting flaw in the Typed JS: A typewriter style animation plugin for WordPress. It stems from insufficient input sanitization and output escaping of the 'typespeed' parameter in all plugin versions up to and including 1.2.0. An authenticated user with Contributor or higher privileges can inject arbitrary JavaScript into the plugin settings, and the payload is persisted and served to any user who views the affected page, allowing the attacker to execute malicious scripts in the victim’s browser.

Impact is confined to installations of the Typed JS: A typewriter style animation plugin provided by mrlegend1235 on WordPress sites, specifically versions 1.0 through 1.2.0. No other plugins or WordPress core components are affected according to the CNA data.

CVM’s CVSS score of 6.4 reflects a medium severity risk. The EPSS score of less than 1% indicates a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be the plugin’s options page: an authenticated Contributor‑level user can post malicious code via the typespeed field, store it in the database, and have it executed when anyone loads the page that includes the plugin. Because the flaw requires authenticated access and only affects users who view the affected content, exploitation is limited to the reach of the victim’s audience.