The Novelist plugin for WordPress contains an improper neutralization of user input during web page generation, allowing an attacker to inject malicious JavaScript that is stored in the database. This stored XSS flaw can execute when any page that displays the affected content is viewed, enabling attackers to deface the site, steal session cookies, or perform phishing attacks within the trust domain of the site.

The vulnerability impacts versions of the Ashley Novelist plugin from the initial release up through 1.2.3. Sites running WordPress with any of those plugin versions are susceptible, regardless of WordPress version. No other vendors or products are listed.

The CVSS score of 5.9 indicates a moderate risk profile, and the EPSS score of less than 1% shows that exploitation is currently unlikely. The flaw is not listed in CISA’s KEV catalog. Attackers would normally require access to author or administrative input zones to persistently inject the payload; unauthenticated exploitation is not evident from the data, so the vector is inferred to be authenticated, author‑level. Once injected, the script runs in the context of the logged‑in user’s browser, potentially bypassing same‑origin restrictions for that user.