The vulnerability is an improper neutralization of input during web page generation that allows stored cross‑site scripting. An attacker who can inject malicious content that is later displayed to other users can execute arbitrary JavaScript in the browser of any user who views the affected page, potentially leading to session hijacking, data theft, or defacement. The flaw is rooted in a classic input validation weakness classified as CWE‑79.

WP Edit plugin for WordPress, versions from earliest release up to and including 4.0.4. The affected vendor is identified as Josh:WP Edit.

The CVSS score of 5.9 indicates moderate severity; the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. Because the vulnerability is stored XSS, an attacker must first persuade a user to submit crafting input—such as via a comment, form, or URL parameter—that is then persisted by the plugin. The lack of a listing in CISA’s KEV catalog implies no publicly documented exploits are known. Nonetheless, any user with write access to the plugin’s input fields remains a potential attack vector.