A stored cross‑site scripting flaw exists in the Terms Popup On User Login plugin, where unfiltered legal terms or conditions text is displayed in a popup. Based on the description, it is inferred that an attacker could inject arbitrary client‑side code via the plugin's administrative input; the code would execute in browsers of any user who sees the popup, potentially compromising the confidentiality and integrity of user interactions on the site.

WordPress installations that have the Term Popup On User Login plugin installed version 2.0.8 or earlier are impacted. No specific WordPress core version is required; any site running the vulnerable plugin version is susceptible. Based on the description, it is inferred that the entry point for exploitation is the administrative input field used to define the legal text shown in the popup.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% suggests that active exploitation is currently rare. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers can exploit the flaw by injecting malicious script into the plugin’s input form; no elevated privileges or additional system compromise are required once the payload is stored. The CVE description does not explicitly state the attack vector; the inference is based on the nature of stored XSS in the plugin.