The vulnerability in Soft8Soft LLC’s Verge3D WordPress plugin enables attackers to inject malicious JavaScript into page content delivered to victims. It stems from improper neutralization of user‑supplied input during web page rendering, a classic Cross‑Site Scripting flaw (CWE‑79). Exploitation could permit cookie theft, session hijacking, or execution of unwanted actions in the victim’s browser.

WordPress sites deploying the Verge3D plugin up to and including version 4.9.3, distributed by Soft8Soft LLC.

The CVSS score of 7.1 indicates a high risk of compromise in a browser context. The EPSS score of less than 1% suggests that, although the vulnerability is severe, the likelihood of exploitation remains low at this time. The issue is not listed in the CISA KEV catalog, so no widespread active exploitation is known. Likely attack vectors involve malicious query strings or form inputs that echo user input back in the page response, enabling attackers to load harmful scripts.