The vulnerability is an Improper Neutralization of Input During Web Page Generation that allows a stored cross‑site scripting (XSS) flaw. An attacker can inject malicious scripts into the GTDB Guitar Tuners plugin’s data fields, causing the script to run whenever a site visitor loads the affected page. This can lead to session hijacking, cookie theft, defacement, or the execution of arbitrary client‑side code, affecting confidentiality and integrity for all users.

WordPress installations that use the GTDB Guitar Tuners plugin from the vendor warmwhisky, versions 4.2.2 and earlier, are susceptible. The issue is present in all releases identified as affecting the plugin up to and including 4.2.2.

The plugin’s CVSS score of 6.5 indicates moderate severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Attack exploitation would require an attacker to supply malicious input that is stored by the plugin, which attackers could inject through any interface that accepts user‑generated content, such as settings pages or public forms. If successful, the XSS propagates to all users who view the affected page.