The FolioVision Filled In plugin for WordPress contains an improper neutralization of input during web page generation, resulting in stored cross‑site scripting. When malicious input is submitted it is saved to the database without adequate escaping, allowing an attacker that injects scripts through the plugin to have those scripts executed whenever any user views the affected content. This type of vulnerability can lead to session hijacking, cookie theft, defacement, or delivery of further malware. The weakness corresponds to CWE‑79.

The vulnerability is present in all releases of the Filled In plugin from the earliest version through 1.9.2. The plugin is developed by FolioVision and is typically used within WordPress sites. Any site that has the plugin installed at a version 1.9.2 or earlier is at risk.

The CVSS score of 7.1 indicates a high severity, but the EPSS score of less than 1 % suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Operating through a vector that requires the attacker to deliver malicious content that is stored by the plugin—as could be done via a cross‑site request forgery attack or by exploiting administrator privileges—the stored XSS can affect any user who views the compromised content. No public exploit details are available, so the risk remains at a moderate‑to‑high level until a patch is applied.