A stored cross‑site scripting (XSS) flaw exists in the Drivr Lite – Google Drive Plugin for WordPress, allowing attackers to embed malicious script via user‑controlled input that is later rendered in the site’s HTML. The vulnerability is categorized as CWE‑79. Because the payload is stored, it can affect any visitor who views the content, potentially leading to session hijacking, credential theft, or defacement.

The issue impacts the awsm.in Drivr Lite – Google Drive Plugin, affecting all releases up to and including version 1.0.1. No specific sub‑versions are listed, so any installation of the plugin within this range is susceptible.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to inject script into the plugin’s data store, likely via the file picker or metadata interface, and then entice site visitors to interact with the stored content for the XSS to execute.