The vulnerability is an improper neutralization of input that results in stored cross‑site scripting (XSS) in the Cleanshooter:ICS Button WordPress plugin. An attacker can inject arbitrary JavaScript that is persistently rendered in web pages served by sites that use the plugin. This flaw allows the execution of malicious code in the browsers of users who view the affected content. The weakness is classified as CWE‑79.

WordPress sites that have installed the Cleanshooter:ICS Button plugin version 0.6 or earlier are vulnerable. No other vendors or product lines are listed as affected according to the CNA data.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score of <1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s data input interfaces that store unsanitized user submissions, allowing an attacker to submit crafted payloads via the WordPress admin interface or content submission forms. Exploitation does not require elevated privileges on the host and can affect any visitor who loads the compromised content.