The vulnerability is a stored cross‑site scripting flaw caused by improper neutralization of user input during web page generation in the Upcasted AWS S3 for WordPress Plugin. An attacker who can submit or manipulate data that the plugin processes may embed malicious scripts, which are then executed in the browsers of users who view the affected content.

WordPress sites using the Upcasted AWS S3 for WordPress Plugin – Upcasted, versions from n/a through <= 3.0.3 are affected. Any installation of the plugin within this version range is vulnerable.

The CVSS score of 6.5 indicates a medium severity risk, while the EPSS score of < 1% suggests a low likelihood of exploitation at this time. The flaw is not listed in CISA KEV. Based on the description, it is inferred that the plugin does not properly escape user‑supplied content before storing and later rendering it in web pages. The attack path most likely requires an attacker to have access to the plugin’s input mechanisms—such as the administrative interface—to create or edit content containing malicious scripts that will be subsequently displayed to site visitors. If successfully exploited, the embedded scripts would run in the browsers of those visitors.