The ABC Notation WordPress plugin contains a CWE‑79 flaw: improper neutralization of user input during web page generation, leading to a stored cross‑site scripting (XSS) vulnerability. Malicious scripts can be stored in the plugin’s content fields and executed in any visitor’s browser that views that content, potentially altering page content or delivering unintended payloads.

The vulnerability affects paulrosen’s ABC Notation WordPress plugin versions from the earliest release through version 6.1.3. Sites running any of these versions are exposed to the risk.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the near term and the vulnerability is not listed in the CISA KEV catalog. Attackers must submit malicious input via the plugin’s interface; the stored payload will then execute in the browsers of any user who views the affected content. The core problem is a CWE‑79 input validation weakness, and mitigation requires applying the vendor’s patch or otherwise ensuring that input is properly sanitized before storage.