The vulnerability arises from improper neutralization of input during web page generation, a classic input validation flaw identified as CWE-79, which permits attackers to embed malicious scripts into the Typing Text plugin’s data store. When a page that renders this stored data is accessed, the embedded script executes in the visitor’s browser, allowing the attacker to run arbitrary client‑side code.

WPDeveloper’s Typing Text plugin versions 1.2.7 and all earlier releases on WordPress sites are affected. Any WordPress installation that deploys these plugin versions exposes the stored‑XSS vulnerability.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% signals a very low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation has been documented. Attackers must supply or influence content that is stored by the plugin; once injected, the malicious script is executed whenever a page rendering that data is viewed.