The vulnerability is a stored cross‑site scripting flaw (CWE‑79) in the WordPress plugin «Подсказки» от DaData.ru. The plugin does not properly neutralize input, allowing saved data to contain executable JavaScript that is rendered on other users’ pages. The description confirms that stored malicious scripts can be injected; typical XSS repercussions such as session hijacking, defacement, or redirection are inferred based on common impact scenarios for XSS.

WordPress sites that have the «Подсказки» от DaData.ru plugin by Shamil Shafeev installed are affected when the plugin version is 1.0.6 or earlier. No newer versions were indicated in the data; therefore any installation using the vulnerable version is impacted regardless of site size or user role.

The CVSS score of 5.9 indicates moderate severity. The EPSS score of < 1 % shows a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Likely exploitation would require an attacker to supply malicious input through the plugin’s data entry points or to create a crafted page that the plugin outputs; once a victim views the affected page, the injected script executes in their browser. This inference is based on the fact that the flaw is stored and rendered in page output.