The vulnerability arises from improper neutralization of user input during web page generation, allowing stored cross‑site scripting (XSS). A malicious actor can submit specially crafted content that the plugin saves and later renders without adequate sanitisation, resulting in the injection of arbitrary scripts that execute in the browsers of any users who view the affected page. This can lead to session hijacking, defacement, or theft of sensitive information.

The issue affects the WordPress Spiderpowa Embed PDF plugin from its first release through version 1.0. WordPress sites that have installed any version of this plugin are vulnerable unless patched or removed.

The CVSS score of 6.5 classifies the flaw as moderate, but the EPSS score of less than 1% indicates a low probability of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is through normal plugin‑provided input fields where an attacker with sufficient privileges (e.g., administrator or contributor) can store malicious payloads that will later be rendered to all site visitors.