This vulnerability stems from improper neutralization of user input in the Terms Before Download WordPress plugin, allowing stored cross‑site scripting. A malicious user can insert scripts that will be rendered and executed in the browsers of anyone who views content that includes the injected data, thereby compromising the integrity of the displayed page.

The issue impacts installations of the Terms Before Download plugin from hiroprot on any WordPress site that has a version from the plugin's earliest release through 1.0.5.

With a CVSS score of 6.5, the flaw is considered moderate severity. The EPSS score of less than 1% indicates a low probability of widespread exploitation. Because the attack does not require privileged credentials and can be performed via normal web interface interactions, any visitor who views the affected content could potentially be exposed to the injected script. The vulnerability is not listed in the CISA KEV catalog, meaning no known active exploitation is documented at present.