The bunny.net WordPress plugin accepts user supplied data and later renders it in a page without applying proper HTML escaping. This leads to a stored Cross‑Site Scripting flaw that allows an attacker to inject arbitrary JavaScript code. When a privileged user or even a normal visitor views the affected page the injected script runs in the context of the site, enabling session cookie theft, credential hijacking, defacement, or other malicious actions. The vulnerability is a classic example of CWE‑79.

The flaw exists in bunny.net WordPress plugin version 2.3.0 and earlier. Any website that installed this plugin from the official WordPress repository is susceptible, regardless of the underlying WordPress core version. The affected product is listed as bunny.net:bunny.net in the CNA product data.

The CVSS v3.1 score of 8.5 marks it as high severity for confidentiality, integrity, and availability. The EPSS score of <1% indicates a very low probability of exploitation in the wild at present, and the vulnerability is not present in the CISA KEV catalog. The attack can be performed by anyone who can submit content that will be stored and rendered, such as comment submitters or content editors. Because the injected script is stored and displayed to all visitors, the impact can extend to any user who accesses the affected page.