The vulnerability allows an attacker to store a malicious script within the Attendance Manager plugin’s data structures, which is then rendered unescaped in subsequent page views. A successful exploitation can execute arbitrary client‑side code within the context of an authenticated or unauthenticated user, enabling data theft, cookie hijacking, or defacement. The weakness is a classic stored cross‑site scripting flaw (CWE‑79).

The affected product is the Attendance Manager WordPress plugin produced by tnomi. Versions up to and including 0.6.2 are vulnerable; no specific patch version is listed in the data, so any release later than 0.6.2 should be checked for a fix.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% signals a low probability of exploitation in the near term. It is not listed in CISA’s KEV catalog, suggesting no known active exploitation cases. The attack vector is likely through the plugin’s web‑based data entry interface, and the flaw is a stored XSS, so it requires the attacker to submit malicious input that is preserved and later reflected in page output. No authentication is explicitly required for the stored input, implying that unauthenticated users could potentially inject payloads if the plugin does not restrict access to modification forms.