Stored cross‑site scripting occurs when the plugin fails to neutralize user‑supplied input before rendering it on webpages, allowing an attacker to inject malicious scripts. This flaw falls under CWE‑79 and can be triggered by any data that the plugin stores for later display.

WordPress sites running the 'Message ticker' plugin by gopiplus are affected. The vulnerability is present in versions up to and including 9.3. No earlier version information is available, so any installation of 9.3 or older must be considered vulnerable.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of public exploitation at present. The flaw is not listed in CISA’s KEV catalog. The attack vector likely involves inserting malicious payloads through the plugin’s input fields, but the description does not specify the required level of site access; this inference is based on typical plugin usage. Once malicious payloads are stored, they are executed in the browsers of any visitor to the affected pages, potentially exposing the site to arbitrary JavaScript execution.