The vulnerability is a stored cross‑site scripting flaw (CWE‑79) that permits an attacker to inject malicious script code into the Hypotext plugin. The injected payload is persisted in the database and subsequently served to any user who views the affected content, giving attackers the ability to steal session cookies, deface pages, or redirect visitors to malicious sites. The flaw stems from improper neutralization of input during web page generation.

WordPress sites that have installed the DEJAN Hypotext plugin through version 1.0.1 are vulnerable. The status of earlier releases is unknown; all versions from the earliest available up to and including 1.0.1 should be treated as affected. The plugin is available under the DEJAN vendor and is distributed as a WordPress plugin.

Based on the description, it is inferred that the attack vector is via the plugin’s input interface. The CVSS score of 6.5 classifies this flaw as medium severity. EPSS indicates a very low exploitation probability (<1 %). The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw by submitting unescaped content through the plugin’s input interface; if the application permits user‑generated content, the attack can be performed remotely and will impact all users who view the stored data.