The vulnerability is a stored Cross‑Site Scripting flaw that enables an attacker to inject malicious script into web pages rendered by WordPress. Once injected, the script runs in the browsers of any user who views the affected page, potentially allowing cookie theft, session hijacking, or site defacement. The issue is governed by the improper neutralization of input during page generation.

The affected product is the TGG WP Optimizer plugin developed by preetindersodhi. All releases from unspecified earliest version through 1.25 are vulnerable, meaning any installation running a version up to and including 1.25 is at risk.

This flaw has a CVSS score of 5.9, indicating moderate severity. The EPSS score is less than 1%, implying a low likelihood of exploitation. It is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker who can submit content that the plugin stores and later views; the stored payload is then rendered unsanitized on the site, affecting all visitors.