Improper neutralization of user input during web page generation allows a stored XSS flaw in the Mad Mimi for WordPress plugin. An attacker who can supply data that is saved by the plugin can have that data rendered as executable code on the target site, potentially leading to data theft, session hijacking, or defacement when other users view affected pages. The weakness is a classic input validation error (CWE‑79).

The vulnerability affects the Mad Mimi for WordPress plugin by Zack Katz, including all released versions up to and including 1.5.1.

The CVSS score of 6.5 indicates a moderate severity for this stored XSS. The EPSS score of less than 1% shows that exploitation is currently expected to be rare, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the plugin’s web interface, where an attacker can submit malicious input that is subsequently stored and rendered for other visitors.