An improper neutralization of input during web page generation causes a stored cross‑site scripting flaw that lets an attacker inject malicious scripts which run in the browser context of any site visitor. The vulnerability falls under CWE‑79 and could be used to deface content, steal cookies or credentials, and redirect users to malicious sites.

The EMC2 Alert Boxes plugin for WordPress, developed by Eric McNiece, is affected in all releases from the earliest available version through 1.3. Any WordPress installation using the plugin in these versions is susceptible.

The CVSS base score is 6.5 and the EPSS score is less than 1%, indicating a moderate severity and a low probability of public exploitation. It is not listed in the CISA KEV catalog. The likely attack path involves a privileged user or an attacker who gains the ability to submit content via the plugin’s alert box editor; from there, malicious JavaScript can be stored and later executed when other visitors view the alert box.