The vulnerability arises from improper neutralization of input during web page generation, allowing stored cross‑site scripting within the farinspace Peekaboo WordPress plugin. An attacker can inject arbitrary JavaScript that will execute in the browsers of any visitor who views pages impacted by the plugin, potentially enabling session hijacking, credential theft, or defacement. The weakness is classified as CWE‑79.

WordPress installations that have installed the farĥinspace Peekaboo plugin, version 1.1 or earlier, are vulnerable. The issue manifests when user‑contributed content is stored and later displayed without proper escaping. Any site running these versions of the plugin is within the affected scope.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the current environment, though the flaw is still publicly known and could be leveraged by a motivated attacker. Since the vulnerability is stored XSS, the attacker would need to inject payloads through legitimate user inputs supported by the plugin, and the attacked hosts must render the malicious content to victim browsers. The vulnerability is not currently listed in CISA's KEV catalog, but it could be discovered by attackers as it can be abused without requiring privileged access or complex prerequisites.