The vulnerability is an improper neutralization of input during web page generation which enables stored Cross‑Site Scripting attacks. An attacker could inject malicious scripts that will execute in the browsers of other visitors to the affected site, potentially stealing session cookies, defacing content, or redirecting users to malicious sites. This flaw is classified as CWE‑79, reflecting its nature of insufficient output encoding.

The affected systems are WordPress installations running the zookatron MyBookProgress by Stormhill Media plugin at version 1.0.8 or earlier. The plugin’s code does not sanitize certain user‑supplied fields, allowing stored XSS payloads to persist in the database and be served to any site visitor.

The CVSS score of 6.5 indicates a medium severity flaw, while the EPSS score of < 1 % suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but an attacker could still exploit it via the plugin’s user input mechanism, especially if the site allows untrusted users to create or edit content managed by the plugin.