Data443 Risk Mitigation, Inc. Welcome Bar intelly‑welcome‑bar is vulnerable to stored cross‑site scripting, allowing malicious input to be saved and executed inside visitors’ browsers. This can lead to credential theft, cookie hijacking, or site defacement when unsuspecting users load the compromised page. The CVSS score of 5.9 classifies the vulnerability as moderate severity but still poses a real risk of user‑level compromise.

The vulnerability affects the Welcome Bar plugin from Data443 Risk Mitigation, Inc., specifically all releases up to and including version 2.0.4. Any WordPress site that has installed a version dated n/a through 2.0.4 is potentially affected.

The EPSS score of < 1% indicates that current exploitation is predicted to be very low, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the stored nature of the flaw means an attacker who can submit a command through the plugin’s configuration interface can inject JavaScript that will be served to every site visitor. The likely attack vector is an administrator or user with access to the plugin’s settings page, who inserts a malicious payload that the plugin fails to neutralize in the generated HTML.