The vulnerability is an Improper Neutralization of Input During Web Page Generation, allowing the WP‑OGP plugin to store malicious scripts that are later executed when a visitor loads a page generated by the plugin. This stored XSS flaw is classified as CWE‑79. If exploited, it can lead to the execution of arbitrary client‑side code, potentially resulting in session hijacking, site defacement, or redirection to malicious sites.

The affected product is the WP‑OGP WordPress plugin, authored by David Miller. All releases up to and including version 1.0.5 are vulnerable; users who have installed any of these versions are at risk. No other vendors or products are listed.

The CVSS score of 5.9 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests that exploitation probability is low at present. The issue is not listed in the CISA KEV catalog. The likely attack vector is through normal web traffic – an attacker submits malicious input via a form that the plugin accepts; the input is then stored and rendered on subsequent page loads, causing the script to run. No additional prerequisites beyond access to the vulnerable input interface are specified, so the risk remains moderate.