The vulnerability is an improperly neutralized input during page generation that allows attackers to store malicious JavaScript. Once the victim views the resulting 404 page, the injected code executes in the visitor’s browser, providing a vector for session hijacking, defacement, or data theft. This flaw is classified as a stored cross‑site scripting weakness (CWE‑79).

WordPress sites that have installed the SeedProd 404 Page by SeedProd plugin in any release prior to version 1.0.2 are vulnerable; the problem exists across all such versions regardless of the host WordPress core version.

The CVSS score of 5.9 places the vulnerability in the moderate severity range, while the EPSS score of less than 1% indicates a low probability of immediate exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack path involves an adversary inserting a harmful script into a field that generates the 404 page or leveraging an administrative interface that persists the payload. Because the exploit triggers when users access an unhandled URL, it requires sufficient traffic or targeted exposure.