The vulnerability is a stored cross-site scripting flaw caused by improper neutralization of input when generating web pages with the Asgaros Forum plugin. An attacker can inject malicious script payloads into forum content that are retained in the database and later served to other users, allowing execution of arbitrary client‑side code in the victim's browser. Such execution could lead to theft of session cookies, credential compromise, or phishing attempts against forum participants.

The affected product is the Asgaros Forum plugin for WordPress, with all releases from the earliest version up through 3.2.1 vulnerable.

The CVSS score of 6.5 classifies the flaw as moderate severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation as of the latest data, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is via user‑generated forum content; the attacker must supply malicious content that the plugin stores and later displays without proper sanitization. Because the flaw is stored XSS, any visitor to the affected forum pages could be impacted, but exploitation requires an attacker to be able to inject content into the forum, either directly or by compromising a user account.