The AppBanners plugin contains a stored Cross‑Site Scripting (CWE‑79) flaw that allows an attacker to save malicious JavaScript in banner content that is subsequently rendered to any user viewing the banner. When executed, the injected code runs in the victim’s browser context, potentially enabling session hijacking, defacement, or redirection to malicious sites. The vulnerability does not require a direct exploit of the WordPress core; it is isolated to the plugin’s input handling.

The issue affects WordPress sites that use Matt Pramschufer’s AppBanners plugin, with all releases up to and including version 1.5.14. Any installation of that plugin that processes banner text or HTML without proper sanitization is vulnerable.

The CVSS score of 5.9 indicates a moderate severity, reflecting the high impact that would be achieved if the payload were delivered. The EPSS score of less than 1 % suggests a very low probability of exploitation presently, though the flaw could be leveraged by an attacker who can submit banner data—likely through an administrative or authoring interface. Because the flaw is listed as not in the CISA KEV catalog, there is no active exploitation known, yet the persistent nature of stored XSS means the vulnerability remains until the content is removed or the plugin is patched.