The vulnerability resides in the Improper Neutralization of Input During Web Page Generation (CWE‑79) in the CodeManas Search with Typesense WordPress plugin, allowing attackers to store malicious script payloads that are later executed by users when they view affected pages. This stored XSS causes malicious scripts to run in the context of site visitors.

WordPress websites that have installed the CodeManas Search with Typesense plugin version 2.0.10 or earlier are affected, as the vulnerability is present in all releases up to and including that version.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of <1% suggests a very low probability of exploitation at this time; the vulnerability is not listed in the CISA KEV catalog. It is inferred that attackers would need to provide malicious input that the plugin stores, which is typically achieved through search queries or form submissions. Because it is stored XSS, once injected it can affect any visitor who loads the compromised content.