The flaw is due to improper neutralization of user input when rendering tabs and accordions content in the web page. Data entered through the WordPress admin interface is stored without proper escaping and subsequently displayed to all visitors. An attacker can inject malicious JavaScript that will execute in every user’s browser, enabling credential theft, session hijacking, defacement or phishing attempts.

Plethora Plugins, plugin Plethora Plugins Tabs + Accordions for WordPress, all released versions up to and including 1.1.5 are affected. Versions newer than 1.1.5 are not known to contain this vulnerability.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires a user with content editing privileges to inject the payload via the WordPress admin dashboard, so it is limited to authenticated users but could be abused if an attacker gains such access.