The vulnerability is a Stored Cross‑Site Scripting flaw in the nurelm Get Posts WordPress plugin, allowing an attacker to inject malicious script into data that is later rendered on a web page. This input is not properly neutralized during web page generation, creating a path for an attacker to execute arbitrary JavaScript in the browsers of any user who views a page containing the stored data. The affected plugin versions are from the earliest release through version 0.6, and the flaw is how the plugin stores and outputs user supplied content.

The issue affects the WordPress plugin nurelm Get Posts, available from the plugin author nurelm. Administrators running any WordPress site that has installed or has ever installed this plugin with a version less than or equal to 0.6 have a potential attack surface. No additional firmware or host versions are mentioned.

The CVSS score is 6.5, indicating a high‑moderate severity. The EPSS score is below 1 %, showing a very low probability of exploitation in the wild at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by submitting malicious content via the plugin’s input interface; unless mitigated, the payload can then be executed in the browser context of any visitor who loads a page where the stored content is displayed. The vulnerability is a typical XSS vector that can lead to session hijacking, defacement, or redirection for users of the affected site.