This vulnerability is an instance of improper neutralization of input during web page generation that allows an attacker to inject arbitrary JavaScript into stored content; this behavior is inferred from the description. The impact is that anyone who views a page with the attacker’s input can execute code in the victim’s browser, constituting a session hijacking or data exfiltration risk. The weakness is a classic stored XSS flaw, identified as CWE‑79.

The flaw affects the WordPress plugin named Today's Date Inserter, supplied by the vendor mulscully, in all releases up to and including version 1.2.1. Any WordPress installation using this plugin without an updated version is susceptible.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of < 1% suggests a low current probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would likely need to submit malicious input to the plugin’s storage mechanism; once stored, the code will run for any visitor of the affected page. The requirement for malicious input and its execution path is inferred from the description, as the exact attack vector is not explicitly detailed.