The vulnerability arises from improper neutralization of input during web page generation, allowing a stored cross‑site scripting flaw in the Simple Nested Menu plugin. An attacker can inject malicious JavaScript that runs in the browser context of any visitor who loads a page containing the affected menu entry. The flaw is classified as CWE‑79 and would enable client‑side code execution, revealing sensitive data or modifying the user experience.

The Simple Nested Menu plugin, developed by Mostafa Shahiri for WordPress, is affected. All versions from the earliest available release through version 1.0 are impacted. The plugin is used to create nested navigation menus within WordPress sites.

The CVSS score of 6.5 indicates moderate severity. With an EPSS score below 1%, the likelihood of exploitation in the near term is low and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require the attacker to be able to create or edit a menu item that persists on the site, after which the stored payload is rendered to any visitor. The likely attack vector is an attacker with sufficient privileges to modify menu content—usually an administrator or editor—though the description does not explicitly state authentication requirements.