The vulnerability is an improper neutralization of input during page generation that allows stored Cross‑Site Scripting. An attacker can inject malicious JavaScript that is later rendered on pages viewed by site visitors, potentially enabling defacement, credential theft, or session hijacking. The weakness is classified as CWE‑79 and is rated as moderately severe with a CVSS score of 6.5.

The issue affects the WordPress MultiVendorX plugin for any version from the earliest build up to and including 4.2.22. Any WordPress site running a vulnerable release of this plugin is susceptible.

The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves input fields that are stored and later rendered—such as product titles, descriptions, or review comments—so an attacker must first submit malicious content that the plugin then saves and displays. The impact is confined to users who view the affected content; there is no remote code execution or direct server compromise.