The vulnerability is an improper neutralization of input during web page generation, allowing attackers to embed JavaScript code that is stored by the SEPA Girocode plugin and executed when a page is rendered. This stored XSS can be used to deface sites, steal session cookies, or facilitate other attacks against users who view the affected pages.

WordPress sites running the SEPA Girocode plugin by mhallmann with a version of 0.5.1 or earlier are affected. No specific operating system or PHP version is listed; the vulnerability exists solely in the plugin’s handling of user input.

The CVSS score of 6.5 indicates a medium‑level risk. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve an attacker submitting malicious content through a form that the plugin stores and later displays to site visitors, requiring a victim to load the page to trigger the payload. Upstream mitigation is expected from a vendor patch when newer plugin releases become available.