The vulnerability allows an attacker to inject malicious JavaScript into data that is later rendered on the site, resulting in a stored XSS flaw. By inserting harmful payloads into the plugin’s color settings, an attacker could target any user who views the affected page, potentially stealing credentials, session tokens, or delivering phishing content. This flaw is categorized as CWE‑79 and poses a moderate risk to confidentiality and integrity of user sessions.

Astoundify:Job Colors for WP Job Manager is affected in all releases from the earliest available version through version 1.0.4. The plugin is a WordPress extension that manages job listings and color formatting. Any WordPress site using this plugin without updating beyond 1.0.4 is vulnerable.

The CVSS score of 5.9 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The flaw is not listed in CISA’s KEV catalog. Exploitation requires the attacker to supply malicious input through the plugin’s interface, which is then stored and later served to browsers. The likely attack vector is web‑based interaction with the plugin’s settings page where the injected script can persist and execute in victim browsers.