The Cache control by Cacholong plugin for WordPress contains a stored cross‑site scripting vulnerability that arises from improper neutralization of user-supplied input. An attacker can embed malicious JavaScript into data that the plugin subsequently renders when generating web pages or displaying stored content, potentially hijacking user sessions, defacing the site, or delivering malware.

WordPress sites that employ the Cache control by Cacholong plugin version 5.4.1 or any earlier release are vulnerable. The issue exists from the earliest available plugin release up to and including 5.4.1, meaning that any installation that has not upgraded beyond this threshold is susceptible.

The CVSS score of 5.9 indicates a moderate severity level. The EPSS score of less than 1% suggests the likelihood of exploitation is very low at the time of publishing, and the vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation yet. Nonetheless, because the flaw permits stored XSS and thus can facilitate credential theft, defacement, or delivery of malware to visitors, the risk remains significant and warrants prompt remediation.