The AAWP Obfuscator plugin can store malicious scripts in the data-aawp-web field because the input is not sanitized or escaped. When a user views the affected page, the unsanitized script runs in that user’s browser, giving the attacker the ability to steal session cookies, deface content, or perform phishing attacks. The flaw is limited to authenticated accounts that have Author or higher privileges, but many WordPress installations grant these roles widely.

WordPress sites that have the elpix AAWP Obfuscator plugin installed in any version up to and including 1.0 are affected. The vulnerability exists in all these releases regardless of configuration. Site administrators should verify whether the plugin is present and at which version.

The CVSS score of 6.4 reflects a moderate damage potential and an attack path that requires prior authentication. The EPSS score of less than 1 % indicates the exploitation probability is currently low, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because the flaw allows persistent arbitrary JavaScript execution, any attacker who gains or already possesses Author‑level credentials can compromise other user sessions or deface the site. The risk remains high for sites that expose the data-aawp-web parameter to content editors without additional filtering.