The vulnerability is a stored Cross‑Site Scripting flaw caused by improper neutralization of input in the WordPress plugin created by the wumii team. An attacker can inject malicious script into content managed through the plugin, and when that content is displayed to other site users the script runs in their browsers, potentially leaking sensitive data or hijacking user sessions.

Any WordPress installation using the wumii Related Posts plugin from the wumii team with a version equal to or earlier than 1.0.5.7 is affected. The vulnerability applies to every instance of this plugin that has not yet been updated beyond that release.

The CVSS score of 7.1 categorises the flaw as high severity, while the very low EPSS score indicates that reported exploitation is unlikely at present. It is not listed in the CISA KEV catalog. Exploitability requires access to the vulnerable plugin’s input fields, which could be achieved by an attacker with permission to add or edit posts or by compromising an administrative account. Once the payload is stored, it will execute on any user who views the affected content.