The vulnerability in the Advanced Typekit plugin results from improper neutralization of user input during page generation, allowing a stored cross‑site scripting flaw. An attacker can embed malicious JavaScript that executes in the browsers of any visitor who loads the affected content. This can lead to cookie theft, session hijacking, defacement, or redirection to malicious sites.

The flaw affects WordPress sites that have installed the Advanced Typekit plugin by Utkarsh Kukreti, versions up to and including 1.0.1. Sites using any older release are also susceptible.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to inject malicious content through the plugin’s input fields, which is then persistently stored and served to all page visitors. The attack vector is reachable via the web interface of the plugin.