The vulnerability arises from improper neutralization of user input before rendering it in a web page. An attacker can store malicious script code in the plugin, which will then execute in the browsers of users who view the affected content, allowing theft of session cookies or execution of arbitrary actions on behalf of the victim. This flaw is a classic web cross‑site scripting (CWE‑79) and can compromise confidentiality and integrity of user sessions.

The issue affects the WebinarPress WordPress plugin for the WPWebinarSystem vendor, specifically all versions up to and including 1.33.28. No specific sub‑versions or modules are singled out beyond the overall plugin release range.

The CVSS score of 5.9 indicates a moderate severity. The EPSS score is reported as less than 1%, suggesting the likelihood of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog. Given that it is a stored XSS flaw, an attacker would need to inject malicious payloads through the plugin’s input interfaces, which requires no special privileges beyond the ability to post or edit content within the plugin. The impact would be limited to users who load the compromised pages.