The vulnerability is a CSRF flaw that allows an attacker to inject malicious scripts into data that is then stored by the Site Search 360 plugin; when the stored data is later displayed, the script runs in the browser of any user viewing the content, potentially enabling session hijacking, data theft, or defacement.

WordPress sites that use the dsky Site Search 360 plugin version 2.1.8 or earlier are impacted. The plugin is distributed by dsky and incorporated into WordPress installations.

The CVSS score of 7.1 reflects a high severity overall. The EPSS of less than 1% indicates that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web request that an attacker can trigger via a malicious site; it requires the victim to be authenticated against the target WordPress site. Although the chance of widespread exploitation is low, the potential impact of stored XSS is significant for exposed users.