Improper neutralization of user input in the Ibtana Visual Editor plugin allows a malicious user to store injected scripts that are later rendered on website pages. The stored XSS flaw, categorized as CWE‑79, can execute arbitrary client‑side code in the browsers of visitors, potentially leading to session hijacking, credential theft, or phishing attacks.

The vulnerability exists in the WordPress Ibtana Visual Editor plugin, produced by VW Themes, in all releases up to and including version 1.2.5.9. Any WordPress site that has installed this plugin or any version of it prior to that release is affected.

The CVSS score of 6.5 reflects a moderate risk, while the EPSS score of < 1% indicates a low probability of exploitation in the wild. The flaw is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need access to the plugin’s administrative input fields or the ability to create or edit content via the editor; therefore the vulnerability is limited to authenticated or content‑editor level privileges on the target site.