This vulnerability in the WordPress cookieBAR plugin allows an attacker to store malicious scripts in the web page output by the plugin, enabling a stored cross‑site scripting (XSS) attack. Stored XSS can lead to session hijacking, credential theft, defacement, or the execution of arbitrary code within the victim’s browser context, thereby compromising confidentiality, integrity, and availability of the application and potentially the underlying system. The weakness is identified as improper neutralization of input during web page generation, CWE‑79.

WordPress sites that use the cookieBAR plugin version 1.7.0 or earlier are affected. The plugin is maintained by the vendor tox82. No further version details are supplied beyond the <= 1.7.0 range.

The CVSS base score of 5.9 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of real‑world exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to convince a site visitor to interact with the stored payload, typically by visiting a maliciously crafted page that displays the compromised content. Because the flaw is stored within the plugin’s output, the risk is limited to users who load pages managed by cookieBAR.