The Listamester WordPress plugin up to version 2.3.5 contains a stored cross-site scripting flaw that allows attackers to inject malicious scripts into data stored by the plugin. This vulnerability arises from improper neutralization of user input during web page generation. When the stored content is later rendered, the injected script can execute in the browsers of any user who visits the affected page. The potential consequences—such as disclosure of sensitive information or session hijacking—are typical of XSS vulnerabilities; these specific impacts are inferred from the nature of the flaw and are not explicitly stated in the CVE entry.

The vulnerability affects the Listamester plugin for WordPress versions up to and including 2.3.5. No additional sub-version details are provided. Site administrators should verify that their plugin version is not <= 2.3.5 and upgrade if necessary.

The CVSS base score of 6.5 indicates moderate severity. The EPSS score is less than 1 percent, implying a low probability of exploitation at present, and the issue is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s data input interfaces, where an attacker can store malicious JavaScript that is executed when any user loads the affected content. This inference is based on the description of a stored XSS flaw.