The vulnerability is a stored Cross‑Site Scripting flaw that allows an attacker to inject malicious JavaScript into the Rollover Tab content. When the data is later displayed to site visitors, the script runs in their browsers. This can lead to theft of session cookies, defacement of the site, phishing, and other client‑side attacks.

The flaw affects any WordPress site running the Sabaoh Rollover Tab plugin version 1.3.2 or earlier. The plugin is available on the WordPress plugin repository and is used to create tabbed interfaces on pages. No specific WordPress core versions are listed, so the issue applies regardless of the core release.

The CVSS score of 6.5 indicates moderate risk, and the EPSS score of less than 1% reflects a low probability of exploitation, yet the vulnerability is exploitable by anyone with the ability to create or edit tab content. An attacker can embed arbitrary JavaScript via the plugin’s content field, and because the content is stored and re‑displayed, the script executes for all visitors who view the affected tabs. The flaw is not listed in CISA’s KEV catalog, but its impact on confidentiality and integrity of session data makes patching a high priority.