An improperly neutralized input flaw in the WordPress pipDisqus plugin allows malicious script code to be stored and executed when a page is rendered. This stored XSS means an attacker could insert JavaScript that runs in the browsers of visitors to the affected site. The CVE description does not state the exact misuse; it simply identifies that embedded scripts can be stored and later executed, which could potentially be used for defacement, phishing, or other malicious actions, but those outcomes are inferred.

The vulnerability affects the pipdig pipDisqus plugin for WordPress versions 1.6 and earlier. Any site that has installed the plugin in those releases is susceptible to stored XSS.

The CVSS score of 5.9 indicates medium overall severity, while the EPSS score of less than one percent suggests a low probability of exploitation at this time. The CVE is not listed in the CISA KEV catalog. The likely attack vector is the submission of malicious content through the plugin’s normal content interfaces; an attacker typically requires the ability to create or edit content, often through an authenticated session or stolen credentials. If such privileges are obtained, the injected script would execute in the browsers of any visitor who loads the compromised content.