The Botnet Attack Blocker plugin in WordPress contains an improper neutralization of user input during web page generation that can result in stored cross‑site scripting. This flaw permits an attacker to inject arbitrary JavaScript into pages rendered by the site, exposing any visitor to malicious code execution. Because the script is stored, the impact persists until the content is cleaned or the plugin updated.

Affected systems comprise any WordPress site running cheesefather Botnet Attack Blocker version two point zero or earlier. The plugin is a third‑party add‑on installed from the WordPress repository and may appear on any site that has elected to enable bot‑blocking functionality. No other WordPress core components are directly implicated.

The reported CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests limited exploitation probability, and the vulnerability is not currently listed in the CISA KEV catalog. Nonetheless, stored XSS is remotelly exploitable, typically through a crafted link that forces a victim's browser to load the compromised page. An attacker who succeeds can hijack user sessions, deface content, or redirect users to phishing sites. Because the flaw resides in the plugin's storage of unsanitized input, any new data volume increases the attack surface.