The vulnerability arises from improper neutralization of user input during web page generation, allowing attacker‑supplied content to be stored and later executed as script on a victim’s browser. If exploited, malicious JavaScript can run in the context of any user visiting a site that uses the vulnerable plugin, potentially defacing the site, stealing session cookies, or redirecting users. The weakness is a classic stored XSS flaw (CWE‑79).

WordPress sites that have the Coffeestudios Pop Up plugin installed with a version number less than or equal to 0.1. This includes all releases from the initial release through version 0.1. No newer versions are mentioned in the data.

The CVSS score of 5.9 marks the vulnerability as medium severity, while the EPSS score of less than 1% indicates a very low probability of widespread exploitation at present. The issue is not listed in the CISA KEV catalog, meaning no known active exploitation at the time of this analysis. The likely attack vector is a stored XSS attack, where an attacker injects malicious script into the plugin’s input fields, which is then rendered unescaped on subsequent page loads for all visitors.