The flaw is a stored XSS vulnerability that permits an attacker to inject malicious script into the web page presented by SensorPress. This flaw arises from improper neutralization of user input when generating content for the plugin’s pages, a problem identified as CWE‑79. When exploited, the injected script can run in the browser of any visitor, allowing the attacker to hijack sessions, steal credentials, deface pages, or perform further phishing attacks. The vulnerability is classified with a CVSS score of 9.8, indicating a high potential for damage across confidentiality and integrity.

The vulnerability affects the SensorPress plugin from brewlabs, spanning all releases up to and including version 1.0. User installations of this plugin, regardless of WordPress site size or purpose, are susceptible if the affected version remains in use.

Despite the very low EPSS score (<1%), the CVSS rating signals a severe risk if an attacker can harness the injection point. The attack vector is inferred to be local or remote input in the plugin’s configuration interface that is stored and replayed in web pages viewed by any user, suggesting that the exploit could be performed by an attacker who can authenticate to the WordPress admin or by delivering a crafted URL that triggers the stored payload. The vulnerability is not listed in CISA KEV, so no known active exploitation campaigns have been reported at present.