The vulnerability allows attacker to store malicious JavaScript within nested page content, causing the script to execute for any viewer of the affected page. This stored XSS can lead to session hijack, defacement or phishing attacks. The weakness is an input validation failure identified by CWE‑79.

WordPress sites that have installed Kyle Phillips:Nested Pages version 3.2.9 or earlier are impacted. The flaw affects users who can create or edit nested page content, such as administrators, editors or other trusted accounts.

The CVSS score of 5.9 indicates moderate severity. An EPSS score of less than 1% shows a very low likelihood of current exploitation. The exploit requires adding or modifying nested page content; based on the description it is inferred that authenticated access is necessary to perform these actions. Because the vulnerability is not listed in CISA’s KEV catalog, the risk of a large‑scale active attack is reduced. Overall, the risk remains moderate but not negligible for sites that continue to run the vulnerable plugin or allow untrusted content creators.