The WPAchievements Free plugin contains an improper neutralization of input during web page generation, enabling stored cross‑site scripting attacks. An attacker can inject malicious script code that is persisted and served to any user who views the affected content. This can lead to theft of session cookies, defacement of user interfaces, or execution of further malicious actions in the victim’s browser.

The vulnerability is present in the Daniel Bakovic WPAchievements Free plugin for WordPress versions up to and including 1.2.0. Systems running WordPress sites that have this plugin installed, especially those with administrative access or content creation permissions, are at risk. No specific operating system or additional components are cited.

The CVSS score of 6.5 categorizes the issue as moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is through compromised or poorly secured administrative accounts that can add or edit plugin content, allowing an attacker to persist malicious payloads in the site’s output.