The Back Button Widget plugin contains an improper neutralization of user input during page generation, allowing attackers to store malicious script code within a WordPress site. This stored cross‑site scripting can run arbitrary JavaScript in the context of any visitor, enabling cookie theft, defacement, or redirection to phishing pages. The weakness is an instance of CWE‑79.

The vulnerability affects all releases of the Back Button Widget plugin from its earliest version up to and including 1.6.8. The affected product is the WPFactory Back Button Widget plugin for WordPress sites. Any WordPress installation that has this plugin installed in a version 1.6.8 or older is susceptible; newer plugin versions have the issue fixed.

The CVSS score of 6.5 reflects moderate severity, while the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is via the normal web interface, as an attacker can inject malicious script through the plugin configuration fields. Because it is a stored XSS, no additional privileges are required and an unauthenticated visitor can trigger the payload when visiting the affected site.