The vulnerability, identified as Improper Neutralization of Input During Web Page Generation, allows an attacker to inject arbitrary client‑side script into data handled by the Post Read Time plugin. Stored XSS means the malicious code is saved in the database and will execute whenever the affected page is rendered, enabling attackers to hijack user sessions, deface content, or execute arbitrary actions on behalf of authenticated users within the scope of the site.

This flaw afflicts the WordPress plugin "Post Read Time" developed by popeating. All released versions from the initial version through 1.2.6 are affected. Users who have installed any of these versions are at risk.

The CVSS score of 5.9 indicates a moderate severity, while the EPSS score being less than 1% suggests that actual exploit attempts are very rare at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an attacker creating or editing plugin content that is later rendered on the site, thereby injecting malicious payloads that trigger when visitors load the page.