The vulnerability is a stored Cross‑Site Scripting flaw in the Woobox plugin for WordPress, caused by improper neutralization of user input during page rendering. An attacker can deliver malicious JavaScript that will be executed in the browsers of any user who views pages generated by a compromised instance of the plugin, potentially allowing cookie theft, session hijacking, or redirection to malicious sites. The weakness aligns with CWE‑79.

Affected systems include installations of the Woobox plugin for WordPress with version numbers from the initial release up to and including 1.6. The product is identified by the vendor name Woobox. No specific sub‑versions are listed beyond the upper bound of 1.6.

The vulnerability has a CVSS score of 6.5, indicating moderate severity. The EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild, and the issue is not currently listed in CISA’s KEV catalog. Exploitation requires that an attacker deliver malicious input that the plugin stores and subsequently renders without proper escaping; users visiting impacted pages would be the target, making the attack vector Web‑application based.