The Lunar plugin for WordPress contains an improper neutralization of input during web page generation, resulting in a stored cross‑site scripting vulnerability. An attacker can submit content that is stored in the database and later displayed without proper escaping, causing malicious scripts to run in the browsers of other site visitors.

The vulnerability affects the sakurapixel Lunar plugin for WordPress, specifically any installation of version 1.3.0 or earlier. The affected product is named Lunar, a photo‑selling plugin that allows users to upload and sell images online.

The CVSS score of 5.9 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a web‑based input field within the plugin that stores user‑generated content in a database and later renders it as part of a web page. If an attacker can inject malicious script into such content, it will execute in the browsers of visitors who view the page.