Improper neutralization of input during page generation in Ben Huson’s List Pages at Depth WordPress plugin allows attackers to store malicious markup in the site’s database. When a user visits a page that renders the affected plugin content, the stored code is delivered and executed in the user’s browser, constituting a stored XSS vulnerability with a CVSS base score of 6.5. This flaw can lead to the compromise of user integrity and the potential defacement of site content.

Ben Huson’s List Pages at Depth plugin for WordPress; all installations from the earliest release up through version 1.5 are vulnerable.

The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalogue, indicating a very low but non‑zero exploitation probability. Based on the description, it is inferred that exploitation would require an attacker to inject and store malicious input, typically via an administrative or content‑creation interface, after which the payload is served to any user who views a page displaying the affected list.