The Broadstreet Ads WordPress plugin contains a stored XSS flaw that allows an attacker to inject malicious scripts into web pages served by the site. The vulnerability arises because user input is not properly escaped before rendering. If exploited, an attacker could run arbitrary client‑side code in the browsers of site visitors, leading to data theft, session hijacking, defacement, or distribution of malware, consistent with CWE‑79.

Broadstreet Ads plugin for WordPress is affected for all releases through and including version 1.52.1. The vulnerability is present in every installation that has not upgraded beyond that version.

The CVSS v3 score of 6.5 indicates moderate severity; the EPSS value of less than 1% implies a low probability of exploitation in the wild. The vulnerability has not been cataloged in CISA’s KEV, and no public exploit has yet been observed. Based on the description, the likely attack vector is via malicious content submitted through the plugin’s input fields, which is then rendered on pages viewed by other users.