The Yandex Site search pinger WordPress plugin contains a stored cross‑site scripting flaw that occurs when the plugin accepts user input during search page generation without proper neutralization, allowing an attacker to inject malicious JavaScript that is then served to all visitors of the affected pages. This injected code can execute in users’ browsers, enabling session hijacking, credential theft, defacement, or other attacks that compromise confidentiality, integrity, and availability of the site and its visitors.

All WordPress sites that have the Yandex Site search pinger plugin installed with a version up to and including 1.5 are affected; no specific WordPress core version requirements are listed, so the vulnerability applies to any site running that plugin version regardless of the core release.

The CVSS score of 5.9 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not flagged in CISA’s KEV catalog. Based on the plugin’s functionality, the likely attack vector involves manipulating the search or other input fields to embed and store malicious scripts, which are then rendered in public pages visited by users.