Based on the description, this is a stored XSS vulnerability caused by improper neutralization of user‑supplied data before it is rendered in a web page in the Inspectlet – User Session Recording and Heatmaps WordPress plugin. When an attacker can insert malicious JavaScript into the plugin’s stored data, that code runs in every visitor’s browser, enabling session hijacking, credential theft, or further malware delivery. The weakness is identified as CWE‑79, a classic client‑side scripting flaw.

WordPress sites that have installed the Inspectlet – User Session Recording and Heatmaps plugin version 2.0 or earlier are affected, any site regardless of theme or other plugins.

The CVSS score of 5.9 reflects moderate seriousness, while an EPSS score of less than 1 % indicates a very low probability of exploitation at present. The vulnerability can be leveraged when an attacker can create or modify data that the plugin stores—likely through an administrative or write‑capable interface. The description does not explicitly state authentication or role requirements, so the exact attack surface depends on the site's configuration and the permissions granted to users. This flaw is not listed in the CISA KEV catalog, so the current threat level is low but can rise if the plugin remains unpatched.