The Laika Pedigree Tree plugin contains an improper neutralization of input during web page generation flaw that allows an attacker to store a malicious script. When a user views a page that includes this persisted script, the browser will execute it in the context of the site, potentially allowing account hijacking, data theft, or redirection. This is a stored XSS (CWE‑79) vulnerability.

The vulnerability exists in the WordPress plugin Laika Pedigree Tree (burria) version 1.4 and all earlier releases. Any WordPress site that has this plugin installed and runs a version up to and including 1.4 is affected.

The CVSS score is 7.1, classifying the flaw as high severity. However, the EPSS score is below 1%, indicating that exploitation attempts are rare at present, and the flaw has not been listed in CISA KEV. The likely attack vector requires the attacker to gain access to the plugin’s administrative interfaces or perform a CSRF attack that submits malicious input, which the plugin then stores and later renders. Because the payload is persistent, any user who subsequently views the affected page will run the injected script.