The flaw arises from improper neutralization of input during web page generation, resulting in a stored cross‑site scripting vulnerability in the EO4WP WordPress plugin. An attacker can inject arbitrary JavaScript that is saved and later rendered by the plugin, enabling cookie theft, session hijacking, defacement, or other client‑side attacks against site visitors.

WordPress sites that run the EO4WP fw‑integration‑for‑emailoctopus plugin, version 1.0.8.4 or earlier, created by Olaf Lederer. The bug is present through all releases up to and including 1.0.8.4.

The CVSS score of 6.5 marks it as a moderate‑severity flaw. The EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The most likely attack vector involves submitting crafted input via the plugin’s data‑entry forms, which is stored and later rendered without proper sanitization, allowing arbitrary code execution in the context of the site’s front‑end.