This vulnerability arises from the WP Project Manager plugin’s failure to properly neutralize user input when generating web pages, allowing a malicious payload to be stored and later rendered as part of the page. An attacker can inject scripts that execute in the browser context of any user who views the compromised content, potentially leading to session hijacking, user impersonation, or defacement of the site.

WeDevs’ WP Project Manager plugin for WordPress versions up through 2.6.22 is affected. The vulnerability applies to all releases from the earliest available version up to and including 2.6.22.

The CVSS score of 5.9 indicates moderate severity, while an EPSS score of less than 1% suggests a low probability of exploitation in the current environment. The vulnerability is not listed in CISA KEV, meaning no known widespread active exploitation has been reported. Attackers can gain access by submitting malicious input through the plugin’s interfaces and, once stored, the payload will execute whenever entitled users view the affected page. No additional system prerequisites beyond normal plugin usage are required.