The Waymark plugin for WordPress contains an improper neutralization of input during web page generation that allows an attacker to inject scripts that are stored in the database and served to visitors. Attackers can deliver malicious code that steals credentials, hijacks sessions, or defaces the site, representing a stored XSS vulnerability identified by CWE‑79.

WordPress installations running the Joe Waymark Waymark plugin version 1.5.0 or earlier are affected. This includes all sites that have not upgraded beyond this version.

The vulnerability has a CVSS score of 6.5, indicating moderate severity, and an EPSS score of less than 1 %, suggesting a low probability of exploitation. It is not listed in the CISA KEV catalog. Likely, an attacker could exploit the flaw by using the plugin’s content editing interface or by adding malicious content to the site’s stored data, resulting in client‑side script execution for any visitor.