The vulnerability arises from insufficient sanitization and output escaping of the simplyconvert_hash option within the SimplyConvert plugin for WordPress. An attacker who can log in with administrator privileges can submit a crafted value for this option, which is then stored and rendered on pages that reference the option. When a user visits such a page, the injected script runs in the browser, potentially allowing the attacker to steal credentials, inject malware, or deface the site. The impact is confined to browsers that load the affected page and requires the attacker to possess administrator access to the site.

All instances of the SimplyConvert plugin by jonahsc for WordPress with versions up to and including 1.0 are affected. The flaw exists in the plugin’s option handling and does not rely on specific WordPress core versions beyond the normal plugin compatibility.

The CVSS score of 4.4 indicates low severity, and the EPSS score of less than 1% suggests that exploitation is unlikely at the macro scale, especially since the attacker must obtain administrator privileges on the target WordPress installation. The vulnerability is not listed in the CISA KEV catalog, further reducing the immediacy of a known widespread exploit. Nonetheless, sites with compromised or weakly protected administrator accounts remain at risk of XSS-mediated attacks that can affect authenticated users.