Improper neutralization of input during web page generation in Nazmur Rahman’s Text Selection Color plugin enables a stored cross‑site scripting flaw. The vulnerability stems from failing to sanitize data that the plugin writes to the WordPress database, allowing malicious scripts to be persisted and executed in the browsers of any user who later views content generated by the plugin. This stored XSS can compromise the integrity of the website’s output and expose visitors to unwanted code execution.

WordPress sites that have the Text Selection Color plugin from Nazmur Rahman installed at version 1.6 or earlier are susceptible. The flaw is confined to the plugin and does not depend on the underlying operating system or hosting environment.

The CVSS base score of 5.9 indicates a moderate overall risk. The EPSS score of <1% suggests a low probability of exploitation at the time of analysis. Because the issue is listed as a stored XSS, an attacker would need to inject malicious payloads via the plugin’s content handling mechanisms, typically through an account with sufficient privileges to modify content. The vulnerability is not currently in CISA’s KEV catalog, so no proven exploitation campaigns have been reported, but the risk remains if an attacker can reach the target user base.