The vulnerability arises from improper neutralization of user input during web page generation, exposing a Stored Cross‑Site Scripting flaw in the WP Discord Invite plugin. Malicious data entered into the plugin can be persisted in the database and served to any visitor, enabling an attacker to execute arbitrary JavaScript in the victim’s browser. This can lead to session hijacking, defacement, theft of credentials from other sites, or malicious redirects. The core weakness is an input validation failure, classified as CWE‑79.

The flaw affects the WordPress plugin ‘WP Discord Invite’ developed by Sarvesh M Rao, versions up through 2.5.3 inclusive. Any WordPress site using any of these releases is potentially compromised.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1% suggests a very low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via the WordPress admin interface or any user input field provided by the plugin. An attacker who can submit content to the plugin can embed JavaScript that will later be rendered for all site visitors, providing the conditions for exploitation.