Improper neutralization of input during web page generation leads to stored cross‑site scripting in the MPL‑Publisher plugin. An attacker can inject malicious scripts that execute in the browsers of users who view affected pages, potentially stealing credentials, defacing content, or redirecting traffic. This flaw falls under CWE‑79 and represents a moderate severity compromise of confidentiality, integrity, and availability of the affected WordPress site.

The vulnerability affects WordPress sites that have the MPL‑Publisher plugin by ferranfg installed, versions up through 2.18.0. The plugin serves as a content publishing interface, and all editions unchanged since the first release are susceptible.

The CVSS score of 6.5 indicates moderate risk overall, while the EPSS score of less than 1 % suggests a relatively low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to submit or influence content stored by the plugin, which may require administrative or contributor access to the WordPress installation. The impact is scoped to any user who accesses the compromised content, potentially allowing widespread script execution within the affected site.