Stored Cross‑Site Scripting (XSS) allows malicious script to persist in a WordPress site’s database and execute whenever an affected page is viewed. The vulnerability stems from improper input neutralization, as defined by CWE‑79. Attackers could obtain user session information, deface content or redirect victims by injecting JavaScript that runs under the privileges of the user who views the page.

The Hive Support WordPress plugin, version 1.2.11 or earlier, is affected. Any WordPress site that has installed or upgraded this plugin before version 1.2.12 runs at risk. The issue is confined to the plugin’s code that outputs stored data without proper sanitization.

The CVSS base score of 6.5 indicates a medium‑level severity. The EPSS score of less than 1% suggests that, at present, the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker submitting malicious input via a form or input field that the plugin stores in the database, which is later rendered unsanitized on public or private pages.