An attacker can register malicious JavaScript within the Request Call Back plugin’s storage, which is later rendered unsanitized in the web page. This stored cross‑site scripting attack enables the injected script to execute in the browsers of any user who views the affected content, potentially allowing session hijacking, defacement, or delivery of additional payloads. The flaw is classified as CWE‑79 and carries a CVSS score of 5.9, indicating moderate severity.

The vulnerable component is the Request Call Back WordPress plugin developed by Scott Salisbury, all releases from the beginning of its availability through version 1.4.1. No other vendors are noted in the CNA data.

Because the EPSS is below 1 % and the issue is not listed in CISA KEV, widespread exploitation is unlikely. Nevertheless the vulnerability can be triggered via the plugin’s input controls or administrative interface, allowing an attacker who can submit data to store a payload that later executes for any visitor who loads the page. The impact is confined to users who view the stored content rather than to the overall system.