An attacker can inject malicious scripts that are stored in the SearchIQ plugin and executed in the browsers of users who view the affected content, leading to defacement, credential theft or session hijacking. This Stored XSS flaw arises from not properly neutralizing input when generating plugin pages, a classic example of CWE‑79.

WordPress sites that have the SearchIQ plugin installed, version 4.7 or earlier. The issue affects the SearchIQ:SearchIQ product from the earliest available version up to 4.7. No specific sub‑versions are listed, so any installation using 4.7 or any prior release should be considered vulnerable.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% shows that the exploitation probability is very low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the search interface or administrative entry points where user input is accepted without sanitization, and an attacker would need to supply malicious script payloads that the plugin stores and later outputs to other users. No privilege elevation is required, and the impact is confined to the affected site and its visitors.