Improper neutralization of user input during page generation allows an attacker to inject malicious scripts that are stored in the database. When the plugin’s configuration page is accessed, the attacker can use a crafted request to place attacker‑controlled JavaScript into stored settings. This stored XSS can run in the browsers of any user who views pages that display the vulnerable plugin’s data, potentially leading to session hijacking, credential theft, or defacement. The weakness is classed as CWE-79, a direct web‑application vulnerability involving reflected or stored attacks.

The plugin frankkoenen:ldap_login_password_and_role_manager, versions from the initial release up to and including 1.0.12, is affected. WordPress sites running the identified plugin version are at risk.

The CVSS v3 score of 7.1 indicates high severity, reflecting high impact on confidentiality and integrity. The EPSS score of less than 1% shows a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, as the flaw relies on a CSRF vector to trigger stored XSS, an attacker who can induce a victim to visit a crafted URL or form can achieve the attack. The risk is real for sites exposed to the public and running the vulnerable plugin.