The vulnerability arises from an improper neutralization of user input during web page generation, allowing an attacker to store malicious script content. Once injected, the script will run whenever any user—including administrators—visits a page that displays the stored data. This can lead to session hijacking, cookie theft, or defacement of the site. The weakness is a classic Stored Cross‑Site Scripting flaw (CWE‑79).

WordPress sites that have installed the Chaser324 Featured Posts Grid plugin in any version through 1.7. No specific sub‑versions are listed, so all releases up to and including 1.7 are potentially vulnerable.

The CVSS score of 7.1 reflects a moderate severity with a Medium level of exploitability. EPSS indicates a very low but non‑zero exploitation probability (<1 %). The vulnerability is not currently listed in CISA’s KEV catalog. The likely attack path involves a CSRF‑based request that coerces an authenticated administrator to submit data containing the malicious script, which the plugin then stores and later renders without proper escaping. Once the script executes, an attacker may hijack sessions or inject additional malicious content.