The Get Use APIs WordPress plugin prior to version 2.0.10 can execute JavaScript contained in imported JSON. A contributor‑level user can force the plugin to import a crafted JSON file, causing the site to render user‑supplied script. This stored XSS vulnerability can lead to session hijacking, data theft, or other client‑side attacks on any visitor who views the compromised content.

The flaw affects the Get Use APIs plugin with any release before 2.0.10, regardless of the WordPress host. Administrators should check the installed plugin version. No additional whitelist or dependences are listed.

The vulnerability has a CVSS score of 5.9, indicating moderate severity. EPSS is below 1%, suggesting low current exploitation probability, and it is not listed in CISA’s Known Exploited Vulnerabilities catalog. Likely attack vectors involve a contributor uploading malicious JSON through the import feature, which is publicly accessible on the site; the necessary conditions are that the user has contributor rights and that the plugin processes the JSON without proper filtering.