The vulnerability is an improper neutralization of input during web page generation that allows an attacker to inject arbitrary JavaScript. This stored XSS can be persisted in the WPtouch plugin and then served to any user who views the affected content, potentially enabling session hijacking, defacement or data theft.

The WPtouch plug‑in for WordPress, any installed version up to and including 4.3.60, is affected.

The CVSS score of 5.9 indicates a medium impact. The EPSS score of < 1% suggests a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is an authenticated or, if the plugin renders user‑supplied content, an unauthenticated attacker injecting malicious script through the plugin’s input fields, with the code then executed when other site visitors load the page.