The vulnerability is a stored cross-site scripting flaw caused by the My Default Post Content plugin failing to neutralize user input before rendering it on web pages. Stored XSS can lead to the execution of arbitrary JavaScript in the context of the victim’s browser, allowing attackers to steal session cookies, deface the site, or redirect users to malicious sites.

This issue affects the WordPress plugin My Default Post Content developed by mrdenny. All releases up to and including version 0.7.3 are vulnerable. No specific minor version numbers are listed beyond this cutoff, but any build <= 0.7.3 contains the flaw.

The CVSS score of 5.9 indicates moderate impact. The EPSS score is below 1 %, implying a low probability of exploitation. The vulnerability is not catalogued in CISA KEV. Attackers would need to supply malicious content via the plugin’s storage interface, typically through an administrative or privileged user account, and any user who views the stored content would be exposed.