The Better Random Redirect plugin for WordPress contains an improper neutralization of input during web page generation that leads to a stored cross‑site scripting vulnerability. The flaw allows attackers to insert malicious scripts that are subsequently served to any visitor of the affected site. If exploited, an attacker can execute arbitrary JavaScript in the victim’s browser, potentially stealing cookies, hijacking sessions, or performing unauthorized actions within the site’s context.

The vulnerability is present in the Better Random Redirect plugin from Robert Peake, affecting every release up to and including version 1.3.20. No affected versions beyond 1.3.20 are listed in the CNA data.

The CVSS score of 5.9 indicates medium impact under the conditions described. The EPSS score is below 1 percent, suggesting a low probability of exploitation in the near term, and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via the plugin’s input forms or settings where an attacker can store malicious script code that is later served to site visitors. No additional prerequisites are specified in the public data.