The issue is an improper neutralization of input during web page generation in the CodeYatri Gutenify plugin, which allows stored cross‑site scripting. An attacker can insert malicious scripts into data that the plugin stores; when that stored data is later displayed, the script runs in the browsers of site visitors.

All versions of the Gutenify plugin up to and including 1.5.7 are affected. WordPress installations that have not upgraded beyond 1.5.7 are susceptible to exploitation.

The CVSS score of 6.5 indicates a moderate impact, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves submitting unsanitized input through Gutenify’s interface so that the malicious script is stored and then rendered to any user who views the affected content. This inference is made from the described stored XSS nature of the flaw and the requirement that the data be rendered in a browser.