The GPXpress plugin for WordPress is vulnerable to stored Cross‑Site Scripting because it fails to sanitize or escape user‑supplied attributes in the 'gpxpress' shortcode. An attacker with contributor‑level or higher access can inject arbitrary JavaScript into a page, which will execute whenever any user views that page. The flaw allows arbitrary script execution in the browsers of visitors to affected pages.

The vulnerability exists in all releases of GPXpress up through and including version 1.3. Systems running WordPress with this plugin installed and configured to allow contributor or higher level roles are affected.

The CVSS score of 6.4 indicates a medium severity. The EPSS score of less than 1% shows that exploitation is considered unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires an authenticated user with contributor level or higher, as stated in the description, and attackers must first gain legitimate access to the site before exploiting the flaw.