The vulnerability in the Live css plugin arises from improper input neutralization during web page generation. Improper sanitization of user supplied content permits a stored cross‑site scripting attack, meaning a malicious payload can persist in the site’s database and later be rendered in any visitor’s browser. This enables an attacker to perform credential theft, manipulate page content, or redirect users to malicious sites without immediate user interaction.

WordPress sites that have installed or maintain the wpion Live css plugin version 1.3 or earlier are affected. The issue is confined to the plugin’s rendering functionality and does not impact the core WordPress platform itself.

The CVSS v3 score of 7.1 indicates a high severity vulnerability, yet the EPSS score of <1% suggests low overall exploit likelihood at the moment. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation. The likely attack vector is through the plugin’s featured interface, where an attacker can submit malicious CSS content that is stored and later served to all visitors. Lack of input validation (CWE‑79) provides the entry point for the flaw.