Gosign – Posts Slider Block allows a stored cross-site scripting (XSS) vulnerability in which unsanitized user input is retained in posts and later rendered to visitors' browsers. The flaw is a classic CWE‑79, and an attacker can embed malicious JavaScript that runs whenever the affected content is viewed, potentially hijacking sessions, defacing the site, or exfiltrating data.

The issue affects the WordPress plugin Gosign – Posts Slider Block for all releases from the earliest available version up to and including version 1.1.0. Site owners running any of these plugin versions should treat the environment as vulnerable.

The CVSS score of 6.5 signals moderate severity, and the EPSS score of less than 1 % indicates a low but non‑zero likelihood of exploitation. The plugin is publicly available on WordPress, and an attacker would typically need the ability to create or modify content through the admin interface to inject the payload. Once injected, the script executes for any visitor who loads the malicious content, exposing all site users to the potential impact. The vulnerability is not listed in the CISA KEV catalogue, suggesting no known widespread exploitation at this time.