The vulnerability is a stored Cross‑Site Scripting flaw that allows an attacker to embed arbitrary scripts into web pages viewed by users. Stored XSS can compromise user accounts, steal session cookies, or deface site content, as the input is not properly neutralized during HTML rendering (CWE‑79). This vulnerability is not a remote code execution flaw, but it can lead to confidentiality and integrity violations through client‑side script execution.

The flaw affects the WPAdverts WordPress plugin developed by Greg Winiarski, specifically versions <= 2.2.1. WordPress sites that have this plugin installed and accept user‑generated content via the plugin are at risk. No specific WordPress core version or PHP requirement is mentioned, indicating the vulnerability is tied solely to the plugin code.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of <1% suggests that currently reported exploitation is low, but the attack vector is feasible through any data entry point that the plugin stores and later displays. The vulnerability is not listed in the CISA KEV catalog. An attacker would likely craft malicious input through the plugin’s submission forms and rely on word‑processing or HTML‑storage mechanisms to persist the payload.