A stored cross‑site scripting flaw exists in the numixtech Page Transition plugin that allows an attacker to inject and persist malicious HTML or JavaScript code. The payload is rendered as part of the page output whenever the affected page is viewed, enabling the attacker to execute arbitrary script inside the victim’s browser and potentially hijack sessions or exfiltrate data.

WordPress installations running the numixtech Page Transition plugin version 1.3 or earlier are affected. Any site that has this plugin installed and permits content or settings that are rendered unescaped is at risk.

The CVSS score of 5.9 categorizes the vulnerability as moderate. The EPSS score of less than 1 % indicates a low probability of exploitation currently, and the vulnerability is not listed in CISA KEV. Based on the nature of a stored XSS flaw, it appears that an attacker would need to submit malicious content that the plugin stores, though the CVE description does not specify whether authentication is required. Once the malicious payload is stored, any visitor to the affected page will execute the code in their browser.