Improper neutralization of input during web page generation allows a stored cross‑site scripting flaw in the arildur Read More Login plugin. Based on the description, the likely attack vector is the submission of malicious input through the plugin’s data entry points, which is then stored and later rendered in WordPress pages, enabling injection of malicious scripts.

WordPress installations that use the arildur Read More Login plugin version 2.0.3 or earlier are vulnerable. All accounts of the plugin released through that version contain the flaw.

The moderate CVSS score of 5.9 reflects the potential for impact. The EPSS score is below 1 %, indicating a low likelihood of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the submission of malicious input via the plugin’s data entry points, which is then stored and executed when the content is displayed.