StellarWP WPComplete allows attacker‑controlled input to be saved in the database and later displayed unescaped in generated web pages, creating a stored cross‑site scripting (XSS) vulnerability. An attacker who can inject content via the plugin’s interface can execute malicious scripts in the browsers of any user who views the affected pages, potentially hijacking sessions, stealing credentials or defacing the site. The weakness is improper input neutralization (CWE‑79).

All WordPress sites running the WPComplete plugin version 2.9.5 or earlier are affected. The vulnerability applies to every release from the initial version through 2.9.5, so any site using that plugin without an upgrade is vulnerable.

The CVSS score is 6.5, indicating a moderate risk level. The EPSS score of less than 1 % reflects a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves an authenticated administrator or user with permission to add or edit content through the plugin. Once the malicious payload is stored, any site visitor will receive it, making the impact potentially global to the site’s audience.