The vulnerability is an improper control of code generation (code injection) that allows an attacker to execute arbitrary code on a server hosting the Visual Text Editor plugin. An attacker can supply malicious input through the editor interface, causing the plugin to generate and run code, which would compromise the confidentiality, integrity, and availability of the entire site.

The affected product is the Govind Visual Text Editor WordPress plugin, versions through 1.2.1. The plugin operates within the WordPress ecosystem, so any WordPress installation using this version is impacted.

The CVSS score of 9.9 signals a critical risk, but the EPSS < 1% indicates that exploitation is unlikely at present. The vulnerability is not listed in CISA KEV. The likely attack vector is a web form that accepts user input, such as the text editor frontend; an authenticated attacker—or potentially an unauthenticated one if the plugin lacks proper access controls—could inject code and gain remote execution.