The Include URL plugin for WordPress contains an improper neutralization of input during web page generation, resulting in a stored cross‑site scripting (XSS) vulnerability. Malicious scripts can be stored by an attacker and executed when other users view pages that include the stored content, potentially allowing arbitrary script execution in victims’ browsers.

The vulnerability affects the Include URL plugin developed by samsk. All releases identified as n/a through version 0.3.5 are affected. Site owners using any version up to and including 0.3.5 should verify their installations and seek a fix.

The CVSS score of 6.5 indicates moderate severity, while the EPSS probability is below 1 %, and the flaw is not listed in CISA’s KEV catalog, suggesting a lower likelihood of widespread exploitation. Based on the description, it is inferred that attackers who can submit content to the plugin are able to inject malicious scripts; the impact applies to all site visitors who view affected content.