The vulnerability arises from improper neutralization of user input when generating web pages, allowing an attacker to inject malicious scripts that are stored in the system and later served to visitors. This stored XSS flaw can be exploited to execute arbitrary JavaScript in the context of authenticated visitors, potentially leading to data theft, session hijacking, or defacement. The weakness corresponds to CWE‑79.

The affected product is the WordPress plugin Contact Form 7 Star Rating with font Awesome from the vendor themelogger, with all releases up to and including version 1.3. No other vendors or products are listed as impacted.

The CVSS score of 5.9 indicates a moderate severity level, while the EPSS score of less than 1% reflects a very low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the stored nature of the flaw, the attack vector is inferred to be through user‑controlled fields within the plugin’s form or rating components, where input is persisted and later rendered to other site users.