The vulnerability is a stored cross‑site scripting flaw that occurs when the Sitekit plugin accepts unsanitized user input and later displays it on a page. Because the attacker can persist malicious scripts in the plugin data, any visitor to the affected website will execute the script in the context of that site. This could lead to theft of credentials, session hijacking, defacement, or further drive‑by attacks. The weakness is described by CWE‑79.

The issue impacts the Sitekit plugin provided by webvitaly for WordPress, versions from the initial release through 1.8. WordPress sites that have the plugin installed and configured to accept input fields are therefore vulnerable. No narrower version range is given beyond the stated upper bound.

The CVSS score of 6.5 indicates a medium‑to‑high severity, while the EPSS score of less than 1% suggests that exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by injecting malicious code into Sitekit fields – a step that likely requires access to the WordPress admin interface or a user role with permission to edit plugin settings. Once the payload is stored, it is served to every visitor who loads the affected page, so no additional conditions beyond basic web access are needed.