Improper neutralization of user input in the DoFollow Case by Case WordPress plugin allows an attacker to store malicious JavaScript that is later rendered as part of a web page. This stored XSS can lead to session hijacking, credential theft, or defacement of pages viewed by other users. The vulnerability is an example of CWE‑79, where input is not sanitized before output.

The vulnerability affects the WordPress plugin DoFollow Case by Case, authored by "apasionados:DoFollow Case by Case," in all versions from n/a through which are 3.5.1. Any site running the plugin at version 3.5.1 or earlier is potentially compromised.

The CVSS score of 5.9 indicates a medium severity. The EPSS score is reported as less than 1%, suggesting a low likelihood of widespread exploitation at present. The vulnerability is not currently listed in the CISA KEV catalog. An attacker must have the ability to submit data via the plugin’s input fields, which is typically available to authorized site administrators or content editors, to inject malicious payloads that are stored and served to other visitors.