This vulnerability arises from improper neutralization of user input during web page generation, allowing an attacker to inject malicious scripts that are stored and later executed when other users load the affected page. If exploited, an attacker could steal cookies, modify page content, or redirect users to malicious sites. The weakness is a classic stored XSS flaw.

The vulnerable component is the WordPress plugin "Show All Comments" from AppJetty, versions up to and including 7.0.1. Users of any WordPress site that has installed or activated a version of this plugin in that range are impacted.

The CVSS score of 5.9 indicates moderate severity. The EPSS score of less than 1% signals that exploitation is currently unlikely, and the vulnerability has not appeared in the CISA KEV catalog. The likely attack vector is inferred: an attacker would submit a comment containing malicious JavaScript, which the plugin would store and later render as part of the page displayed to all visitors. Once a victim loads the page, the script executes in their browser context.