The vulnerability is an instance of Improper Neutralization of Input During Web Page Generation. An attacker can inject malicious script code into fields managed by the MultiVendorX plugin; the code is then rendered unsanitized in the web page, enabling Cross‑Site Scripting. If exploited, the attacker can hijack user sessions, steal cookies, deface the site, or track user activity. The flaw corresponds to CWE‑79, which focuses on inadequate input sanitization.

All installations of the WordPress MultiVendorX plugin up to and including version 4.2.13 are affected. No other plugin versions or products are listed as impacted.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. The EPSS score of less than 1% shows a low likelihood of active exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to submit data to the plugin’s input fields, typically through the site’s administrative or vendor interfaces. Once injected, the malicious payload persists on the site and can affect any user who views the affected page.