Chris McCoy’s Bacon Ipsum WordPress plugin is vulnerable to stored cross‑site scripting. The flaw allows an attacker to inject malicious script into site content that is saved by the plugin and subsequently served to all visitors. This can lead to client‑side script execution, cookie theft, defacement or redirection, but the description does not specify higher‑level impacts such as privilege escalation.

WordPress sites running the Bacon Ipsum plugin version 2.4 or earlier are affected. The vulnerability spans all releases that are at or below 2.4, as no minimum version is provided.

The problem carries a CVSS score of 6.5 and an EPSS score below 1 %, indicating that while the vulnerability is moderate, the likelihood of exploitation is currently low and it is not listed in the CISA KEV catalog. The attack scenario typically requires a user with permission to submit or edit content via the plugin; the payload is stored and later rendered in the page, so exploiting it allows the attacker to execute arbitrary JavaScript in the context of any visitor’s browser. In the absence of more detailed info, the attack vector is inferred to be a web‑based input that stores data.