This vulnerability is an instance of improper neutralization of input during web page generation, allowing a stored cross‑site scripting flaw. The flaw can be triggered by incorrect handling of user supplied data within the SheetDB WordPress plugin, enabling an attacker to inject malicious client‑side scripts that execute when the affected page is viewed. The potential impact includes session hijacking, credential theft, phishing, and defacement for users who view the compromised content. The weakness is identified as CWE‑79.

WordPress sites running the SheetDB plugin version 1.3.4 or earlier are affected. No other product or version information is listed.

The CVSS score of 6.5 classifies the vulnerability as medium severity, but the EPSS score of less than 1 % indicates a very low likelihood of exploitation at this time. The vulnerability is not currently listed in CISA’s KEV catalog. Based on the description, the likely attack vector is through submission of malicious input that is stored by the plugin and served to site visitors. An attacker would need the ability to submit such input, which could be achieved via authenticated administrative access or through user‑submitted data fields that the plugin accepts without proper sanitization.