The vulnerability is an improper neutralization of user input during page generation, allowing an attacker to store malicious scripts in the site’s content. The stored XSS can then be executed in the browsers of any visitor to the affected page, potentially compromising user sessions, injecting malicious content, or facilitating phishing attacks. The weakness is a classic cross‑site scripting scenario documented as CWE‑79.

Affected software is the Jose Conti Link Shield WordPress plugin, versions up to and including 0.5.4. The vulnerability risks all installations that have not upgraded beyond that release, regardless of site size or user base.

The CVSS score of 7.1 indicates a high‑severity flaw. The EPSS score is less than 1 %, suggesting that current exploit activity is low, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is inferred to involve CSRF‑like forged requests, enabling an attacker to inject script payloads without direct interaction with the victim. Exploitation would require that the attacker can send malicious input to the plugin’s processing routine, typically through a crafted form submission or link.