This vulnerability represents an Improper Neutralization of Input During Web Page Generation that permits an attacker to store malicious script code in the ARPrice plugin’s data. A stored XSS flaw means that the injected payload is saved in the database and subsequently rendered in the web page for any user who views the affected content. The consequence is that a victim’s browser can execute arbitrary JavaScript in the context of the site, which may allow session hijacking, defacement, or the delivery of phishing content to users.

The affected product is the reputeinfosystems ARPrice WordPress plugin, version 4.1.3 and any earlier releases. WordPress sites that have this plugin installed and have not upgraded beyond 4.1.3 are susceptible.

The CVSS score of 6.5 indicates a moderate severity; the EPSS score of less than 1% reflects a very low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a web‑based input mechanism within the plugin that allows content to be stored without proper sanitization, allowing an attacker to inject script that is later served to users. No special privileges, network access or client‑side scripting are required beyond a legitimate user interaction with the plugin’s input fields.