Improper neutralization of input during web page generation in the Kush Micro News plugin allows stored XSS. An attacker who can inject malicious JavaScript into content managed by the plugin can cause a victim’s browser to execute that script when viewing the affected page, potentially leading to theft of credentials, session hijacking, or site defacement. The vulnerability is a classic input sanitization failure classified as CWE‑79.

WordPress installations that have the Kush Micro News plugin installed at version 1.6.7 or earlier are affected. The exploit is limited to instances where the plugin’s storage fields are accessible.

The CVSS score of 7.1 indicates high impact. The EPSS score of less than 1% suggests that exploitation attempts are currently uncommon. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user with privileges to insert content into the plugin’s storage; this inference is derived from the nature of stored XSS, as the input description does not specify the exact requirements.