The reported issue is an improper neutralization of input during web page generation, allowing a stored cross‑site scripting (XSS) attack. An attacker can exploit the plugin’s CSRF weakness to submit malicious scripts that are later displayed to site visitors. The stored XSS can lead to cookie theft, session hijacking, defacement or other malicious payloads that affect all users who view the affected content.

Vulnerable instances run the Theasys plugin for WordPress, versions up to and including 1.0.1. Any WordPress installation that has not upgraded past this version is at risk.

The CVSS base score of 7.1 indicates a high severity with medium impact on confidentiality, integrity and availability. The EPSS score of less than 1% suggests that exploitation is uncommon but not impossible. Because the flaw requires a CSRF vector, an attacker must be able to trick a logged‑in user or administrator into submitting a crafted request; the vulnerability is not active vulnerable from the web server alone. The flaw is not currently listed in the CISA KEV catalog, but its high CVSS makes it a priority for rapid mitigation.