Improper neutralization of script‑related HTML tags allows malicious code to be stored in the Listamester plugin and delivered to other visitors when they view the affected content. The stored payload runs in the victim’s browser, enabling token theft, defacement, or redirection to phishing sites. The likely attack vector is submission or modification of content through the plugin’s input interfaces, which then persists the payload in the database.

All installations of the Listamester WordPress plugin version 2.3.4 and earlier are affected. Any WordPress site that has the plugin enabled and permits user‑generated content via Listamester is vulnerable, regardless of theme or other plugins.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests that widespread exploitation is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attacker would need to submit or modify content through the plugin’s input interfaces; the required privileges are not specified but may be limited to users with access to those forms. Once stored, the malicious script is executed for every visitor who loads the compromised content, providing broad impact on sites that rely on Listamester for content creation.