The vulnerability is an improper neutralization of input during web page generation, allowing stored cross-site scripting. An attacker can inject malicious scripts into content handled by the Progress Bar plugin, causing those scripts to execute in the browsers of any user who views the affected page. This may lead to session hijacking, defacement, or other malicious actions, depending on the victim’s session and privileges. The weakness corresponds to CWE-79, and the likely attack vector is the plugin’s input channels, where a malicious user injects scripts that are stored and later rendered unfiltered.

The affected product is the Progress Bar plugin by Chris Reynolds, all versions from the earliest release up through 2.2.3. Any installation of the plugin within this version range is susceptible until an update that addresses the flaw is installed or the plugin is removed.

The CVSS score of 6.5 denotes a medium‑severity risk. The EPSS score of less than 1% indicates a low probability of exploitation at the current time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to submit malicious content via the plugin’s input mechanisms; the plugin then renders that content unfiltered when generating a page. If such content is inserted, the stored XSS will execute in every visitor’s browser, potentially compromising user credentials and site integrity.