The WP Content Security Plugin allows for stored cross‑site scripting by failing to sanitize or escape the blocked‑uri and effective‑directive parameters. An unauthenticated attacker can inject arbitrary JavaScript into these fields, which is subsequently stored and rendered in web pages. When a site visitor accesses a page containing the injected code, the script executes in the user's browser, potentially enabling malicious actions such as session hijacking, data theft, or defacement.

Vendors and products impacted are the WordPress plugin named WP Content Security Plugin developed by dyland. All releases from the initial version up through and including 2.3 are affected; users of these versions should verify whether they have installed the plugin and consider the version number. No other systems are listed.

The CVSS score is 7.2, indicating a high severity. The EPSS score is reported as less than 1 %, suggesting a low but non‑zero likelihood of exploitation; the vulnerability is not currently listed in the CISA KEV catalog. Because the flaw is accessed through the public web interface and does not require authentication, it is considered unauthenticated. Exploitation requires the attacker to submit a value for either blocked‑uri or effective‑directive that contains malicious script; the stored data is then served to all users who view the affected page.