Infoway LLC’s Ebook Downloader plugin is vulnerable to Stored Cross‑Site Scripting due to improper neutralization of input when generating web pages. The flaw lets an attacker inject malicious script into the plugin’s content storage, which is subsequently rendered on the site. When executed, the script can steal user cookies, hijack sessions, or deface the site, thereby compromising confidentiality, integrity, and possibly availability for site visitors. The weakness is classified as CWE‑79.

WordPress sites that use Infoway LLC’s Ebook Downloader plugin, version 1.0 or earlier. No additional vendor or product variants are listed as affected.

The CVSS score of 6.5 reflects a moderate severity, but the EPSS score of less than 1% indicates a very low likelihood of active exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is presumably through form submissions or administrative content entry within the plugin, where malicious payloads are stored and later displayed to site visitors. The risk to stakeholders is moderate; however, the exploitation probability remains low.