An improper neutralization of input during web page generation allows attacker‑input to be stored and later rendered without sanitization. This vulnerability is a stored cross‑site scripting flaw (CWE‑79) that can result in session hijacking, data disclosure, and defacement of the site by malicious code executed in the context of site visitors.

The affected product is the Pixeline issuuPress WordPress plugin, versions from the earliest available up to and including 1.3.2. All installations running this plugin version range are impacted.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of <1% suggests low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via the plugin’s content or settings fields where user input is stored and later rendered on site pages; an attacker with access to these input points could inject malicious scripts that will execute in the browsers of anyone who views the affected pages.