The vulnerability is a stored Cross‑Site Scripting flaw where user‑controlled input is incorporated into web page content without proper neutralization. An attacker who can inject and store malicious script could execute code in the browser context of any visitor to the affected WordPress site, potentially allowing session hijacking, credential theft, defacement, or other client‑side attacks. The weakness is identified as CWE-79.

WordPress plugin "Auction Nudge – Your eBay on Your Site" produced by Joe is affected. All releases from the earliest to version 7.2.0 are vulnerable.

The CVSS score of 5.9 indicates moderate severity, and the extremely low EPSS (<1%) suggests that widespread exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is stored XSS, the attacker must place malicious content into a field that is later rendered to users; thus the likely attack vector involves an authenticated user (such as an administrator or a valid contributor) inserting script into a form or message that is subsequently displayed to site visitors. Once the payload is stored, any user visiting the affected page can be impacted.