The HelloAsso "helloasso" plugin for WordPress contains an improper neutralization of user‑supplied input during page generation, allowing a stored cross‑site scripting (XSS) flaw. An attacker who can insert malicious scripts into the plugin’s input fields will cause them to be rendered unescaped in the browser of any visitor to the affected page, potentially enabling script execution in the victim’s browser.

WordPress sites that run the HelloAsso "helloasso" plugin version 1.1.11 or earlier are affected. The issue is disclosed for all release versions up to and including 1.1.11, with no later versions identified as vulnerable.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% reflects a very low probability of exploitation at the time of reporting. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the plugin’s web interface, where the attacker must supply malicious input that the plugin stores and subsequently displays without proper encoding. Successful exploitation would result in arbitrary script execution on all browsers that view the affected page.