Improper Neutralization of Input During Web Page Generation permits stored XSS. A malicious actor can inject script code that persists in the CoverManager plugin’s database, causing the code to run under the context of any visitor who views the affected page. This can lead to session hijacking, data theft, and defacement. The core weakness is reflected in CWE‑79, where input is insufficiently sanitized before rendering.

The defect is present in every released version of the CoverManager plugin up through 0.0.1, distributed by vendor carperfer. All installations of this plugin that have not been updated beyond version 0.0.1 are vulnerable. The problem affects WordPress sites that use this plugin for content management and display.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests that the vulnerability is unlikely to be widely exploited at present, and it is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s content creation interface; an attacker who can supply content that is stored by CoverManager and subsequently viewed by other users can launch the XSS. Exploitation requires the ability to add or modify content, but does not necessitate system‑wide privileges.