The CVE describes a Cross‑Site Request Forgery vulnerability in the WP SexyLightBox plugin that permits an attacker to inject arbitrary JavaScript into the WordPress database. When a forged request is processed, the malicious script is stored and later executed in the browsers of users who view the affected content. This Stored XSS can lead to session hijacking, credential theft, defacement, or other consequences arising from code execution in the victim’s browser.

The vulnerability affects all releases of the WP SexyLightBox plugin for WordPress authored by Mario Aguiar that are version 0.5.3 or earlier. Any WordPress site running a vulnerable instance of the plugin is at risk; no other products are listed as affected.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be web-based, requiring an attacker to trick a logged‑in administrator or editor into visiting a crafted URL that submits the forged request. Successful exploitation would grant the attacker persistent stored XSS capabilities.