The WPAvatar plugin contains an improper neutralization of input during web page generation, allowing stored cross‑site scripting. An attacker can inject malicious script that is persisted and served to any user who views the affected content. This can lead to theft of credentials, session hijacking, defacement, or the execution of arbitrary code in the context of other site visitors. The weakness is classified as CWE‑79.

WPAvatar, the WordPress avatar plugin provided by 文派翻译（WP Chinese Translation）, is vulnerable. All released plugin versions from the initial release through version 1.9.4 are affected. WordPress sites that have installed any of these versions of WPAvatar are at risk.

The CVSS score of 6.5 indicates medium severity. The EPSS score of less than 1% suggests an uncommon exploitation probability at the time of analysis, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is stored XSS through an input field in the plugin that is not properly sanitized, probably requiring a user or administrator to submit malicious content that is later rendered for all visitors. Based on the description, it is inferred that the attacker must supply the payload via a plugin interface that stores the data and then displays it in subsequent pages.