The CC Circle Progress Bar plugin for WordPress allows attackers to store malicious script payloads in the web page because it fails to properly neutralize user input. This stored XSS flaw (CWE‑79) enables a malicious actor to inject arbitrary JavaScript that runs with the privileges of anyone who views the affected page. The consequences include cookie theft, session hijacking, defacement, and the execution of further client‑side attacks.

The vulnerability affects WordPress installations running the CC Circle Progress Bar plugin version 1.0.0 and earlier, developed by Harun R. Rayhan (thecrazycoder). No later versions are documented as affected.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation under current conditions. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers can exploit the vulnerability by inserting malicious input through the plugin’s configuration or content fields; the payload is persisted and executed whenever the affected page is rendered, requiring the victim to view the page.