The Simple Spoiler plugin for WordPress allows stored cross‑site scripting (XSS) because it does not properly neutralize user input before rendering it on web pages. This flaw, classified as CWE‑79, enables an attacker to inject arbitrary JavaScript that is then automatically executed whenever a site visitor loads a page that displays the stored content. Potential consequences include session hijacking, cookie theft, defacement, and other malicious client‑side actions.

WordPress sites running the Webliberty Simple Spoiler plugin at version 1.4 or earlier are vulnerable. Any installation using this plugin is at risk until the issue is addressed by a newer release.

With a CVSS score of 6.5 the flaw is considered moderate in severity. The EPSS score of less than 1 % suggests that the likelihood of active exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is stored XSS: an attacker with access to the plugin’s input fields can create malicious content that is subsequently served to all visitors, making the vulnerability exploitable when privileged users add or edit spoiler content.