The vulnerability is an improper neutralization of input during web page generation that allows stored XSS to be injected through the Wired Impact Volunteer Management plugin. An attacker who can supply arbitrary content into any input field that is later displayed by the plugin can cause a victim’s browser to execute malicious scripts. This can lead to credential theft, session hijacking, defacement of content, or execution of further attacks in the context of the authenticated user who views the affected page.

The issue affects the Wired Impact Volunteer Management WordPress plugin on all installations using version 2.5 or earlier. This includes all WordPress sites that have not upgraded beyond that release.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of less than 1% shows a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote through user‑supplied input fields that the plugin stores and later renders, which requires the attacker to be able to submit content that the plugin accepts as safe. Exploitation would require the victim to view the affected page in browser to trigger the XSS payload.