The vulnerability allows an attacker to inject malicious JavaScript that is permanently stored within the WordPress Data Guard plugin. When a user subsequently views content, the browser executes the injected script, which can lead to credential theft, defacement, or unauthorized actions on behalf of the victim. This is a typical Cross‑Site Scripting weakness (CWE‑79) that compromises user confidentiality and trust in the site.

WordPress Data Guard plugin versions up to and including 8 are affected. The flaw exists in the WordPress Data Guard data‑guard functionality that is accessible to website administrators and users with any capacity to submit content through the plugin.

The CVSS score of 7.1 indicates a high impact potential, while the EPSS score of less than 1 % suggests a low probability of exploitation at the time of analysis. The flaw is not listed in the CISA KEV catalogue, implying no known widespread exploitation. The likely attack vector is a CSRF request that writes malicious payloads, requiring the victim to be logged into the site or possessing sufficient user privileges. Given the stored nature of the XSS, all users who view the affected content may be impacted.