Brecht:Custom Related Posts contains an input sanitization flaw that allows an attacker to inject arbitrary JavaScript into web pages rendered to site visitors. The stored nature of the flaw means malicious code can persist across sessions and affect every user who views the affected content. Successful exploitation could enable cookie theft, session hijacking, defacement, or the delivery of further malware to clients.

The vulnerable component is the Custom Related Posts plugin released by Brecht, affecting all installed versions up to and including 1.7.4. Any WordPress site that has this plugin active and allows administrators or content editors to create or edit related post entries is potentially exposed.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog, so no evidence of widespread active exploitation exists yet. The attack vector can be inferred to require an authenticated user with permission to add or edit posts through the Custom Related Posts interface; the injected script is then served to all site visitors when the content is displayed.