Improper neutralization of input during web page generation in the Music Press Pro plugin allows an attacker to store malicious scripts in the site’s content. An attacker can inject JavaScript that will execute in the context of any user who views the affected page, potentially leading to the theft of session cookies, credential hijacking, or distribution of malware. The weakness is a classic stored cross‑site scripting flaw (CWE‑79).

Vulnerable instances are WordPress sites running Music Press Pro version 1.4.6 or earlier. The flaw exists in all releases from the plugin’s initial release up to and including the 1.4.6 tier. Sites with older or unpatched versions of the plugin are susceptible.

CVE‑2025‑22653 carries a CVSS score of 6.5, indicating moderate severity. EPSS is below 1 %, suggesting that, as of this data set, the likelihood of exploitation is low. The vulnerability is not listed in CISA’s KEV catalog. The most probable attack vector comes from user input fields that the plugin stores, such as song titles, descriptions or custom data areas, and is inferred from the description of a ‘stored XSS’ flaw. An attacker would need to be able to submit content that the plugin saves and then convince an end‑user to view that content.