Technical impact
The vulnerability is an improper neutralization of input that allows an attacker to store malicious script code in the Daily Proverb plugin’s content, which is then rendered directly into web pages. When a victim’s browser loads a page containing that stored data, the script runs with the privileges of the site, potentially stealing session cookies, defacing content, or redirecting users to malicious sites. The weakness is a classic CWES-79 Cross‑Site Scripting flaw.
Affected Systems
WordPress sites that have installed the jd7777 Daily Proverb plugin version 2.0.3 or earlier are affected. The vulnerability encompasses all releases starting from the first public release up to and including 2.0.3.
Risk and Exploitability
With a CVSS score of 6.5 the issue is considered moderate severity. The EPSS score of less than 1% suggests low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a web‑based injection where a user with access to the plugin’s content entry interface can insert script tags that become embedded in the site’s output. Successful exploitation grants an attacker the ability to run arbitrary JavaScript in the browsers of anyone who visits the affected pages.
EUVD