The TemplatesNext ToolKit plugin contains an improper neutralization of input during web page generation that allows stored cross‑site scripting. Malicious code injected through the plugin can be persisted in its database and then executed in the browsers of any user who views the affected content, thereby enabling the attacker to run arbitrary scripts in the victim’s context.

WordPress sites that use the TemplatesNext ToolKit plugin version 3.2.9 or earlier, as distributed by the vendor marsian.

The CVSS score of 6.5 categorizes the vulnerability as moderate, and the EPSS score of less than 1% indicates a very low probability that exploitation has occurred. The issue is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the plugin’s administrative template editing interface, where an attacker with sufficient privileges can insert malicious scripts that are stored and later served to site visitors.