The vulnerability is a stored XSS in Leartes.NET’s Leartes TRY Exchange Rates WordPress plugin. It results in the application not correctly neutralizing user input that becomes part of generated web pages, allowing attackers to inject malicious scripts that will execute in the browsers of users who view the affected content. This can lead to session hijacking, credential theft or defacement of the site, as the injected code runs with the privileges of the victim user.

Vendors and products affected include Leartes.NET’s Leartes TRY Exchange Rates WordPress plugin, versions from the initial release through 2.1. Any WordPress site running this plugin within that version range is at risk until a patch or update is applied.

The CVSS score of 6.5 indicates moderate severity, and the extremely low EPSS score (<1%) suggests that exploit activity is currently rare. The vulnerability is not listed in CISA’s KEV catalog. Attackers would likely target sites exposed to the web, feeding malicious content through any writable fields exposed by the plugin and hoping that an administrator or other privileged user would load the page, triggering script execution. The presence of stored data makes the attack feasible without needing to rely on user interaction beyond page viewing.