The Smartarget plugin for WordPress suffers from an improper neutralization of user input when generating web pages, which permits a stored cross‑site scripting flaw (CWE‑79). The vulnerability allows an attacker to place malicious script code within the plugin’s data, which is retained in the database and later displayed to site visitors. Because the script is stored, the effect is not limited to the initial request but can be re‑executed for any user who views the affected page.

This flaw affects all instances of the Smartarget plugin for WordPress up to and including version 1.5.3, as the vulnerable code is present in every release from the initial version through that number. Any site using any of those releases is exposed.

The CVSS score of 6.5 indicates a medium severity for this stored XSS, while the EPSS score of less than 1% suggests a very low probability of exploitation at the time the data was collected. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to submit malicious input via the plugin’s interface; the input is then stored by the system and rendered into the page viewed by other users. Given the medium severity and the low exploitation probability, the overall risk is moderate but the flaw should be remediated promptly.