This vulnerability arises from improper neutralization of user input, enabling an attacker to inject malicious script that gets stored in the WordPress database. When a page containing that data is later rendered, the script is executed in the victim’s browser, compromising confidentiality, integrity, and, based on the description, it is inferred that an attacker may be able to perform session hijacking or defacement. The CVSS score of 5.9 reflects medium severity; the issue is classed as stored XSS, a well‑known attack vector that can affect any user who views the compromised content.

The flaw exists in the AppJetty WP jQuery DataTable plugin for WordPress, affecting all releases from the earliest version through 4.1.0. Sites running this plugin without updating to a version later than 4.1.0 are exposed.

The EPSS score is under 1%, indicating a relatively low likelihood of exploitation today, yet the vulnerability remains active and listed in public advisories. Because the flaw allows persistence on the site, an attacker could deploy malicious scripts that impact all users of the affected WordPress installation. The risk is moderate with a CVSS of 5.9, and the vulnerability is not yet part of the CISA KEV catalog, but patching is recommended to preclude potential exploitation.