Improper neutralization of user input during web page generation allows an attacker to store malicious scripts in the include-file plugin, which are executed when the page is rendered. The stored XSS can lead to cookie theft, session hijack, defacement, or the injection of additional malware. The weakness is identified as CWE‑79 and grants attackers the ability to execute arbitrary client‑side code in the context of legitimate site visitors.

The tstafford include-file WordPress plugin, versions from the initial release up to and including version 1.0. Users of any WordPress site that have installed this plugin and are running an affected version are potentially vulnerable.

With a CVSS score of 6.5 the vulnerability is of medium severity. The EPSS score of less than 1% implies a low probability of active exploitation, and the vulnerability is not catalogued in the CISA KEV database. The likely attack vector is through the plugin’s input interface, where an attacker with the ability to submit data (admin or guest, depending on configuration) could embed malicious payloads that are then rendered in the page. If the site’s users visit a page that reflects the stored input, the attack would succeed.