The 360 View WordPress plugin has an improper neutralization of user‑supplied input that is rendered without escaping. This flaw allows a stored cross‑site scripting vulnerability, where malicious code inserted via the plugin can persist in the database and be executed in the browsers of any visitor to affected pages. Because the input is stored and later displayed, the vulnerability affects the integrity of the displayed content and allows arbitrary JavaScript execution in the context of the site visitor.

All installations of the 360 View plugin released with version 1.1.0 or earlier are affected. Sites that have not applied a newer release are potentially vulnerable.

The vulnerability receives a CVSS score of 6.5, indicating a moderate risk level. The EPSS score is less than 1%, suggesting that exploitation opportunities are currently infrequent. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to inject malicious code via the plugin’s input interface—most likely an administrative or content‑creation workflow that lacks proper sanitization. Once stored, any user who accesses a page that renders the data would have the injected script executed.