Responsify WP plugin contains a stored Cross‑Site Scripting vulnerability due to improper neutralization of input. Content submitted through the plugin is stored and rendered on webpages without proper sanitization or encoding, allowing an attacker to inject arbitrary JavaScript that will execute in the browsers of site visitors. The primary impact is client‑side script execution, which could lead to session hijacking, defacement, or data exfiltration for users who view the affected pages.

Any WordPress site running the Responsify WP plugin version 1.9.11 or earlier, from the initial release through 1.9.11, is affected. The vulnerability may be present on any domain or subdomain where the plugin is active.

With a CVSS score of 5.9 the vulnerability is considered moderate severity. The EPSS score of less than 1 % indicates a low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need access to an input interface of the plugin to store malicious payloads, which then execute in the browsers of visitors who view the affected content. The risk is limited to client‑side impact; no direct compromise of the server or database occurs. Mitigation actions are recommended even with the low EPSS because client‑side attacks can still be harmful.