The vulnerability is an Improper Neutralization of Input During Web Page Generation that allows stored XSS. An attacker can inject malicious scripts that are persisted by the Gutenify plugin and displayed to any visitor who views the affected content, potentially leading to credential theft, defacement, or session hijacking. The impact is limited to client‑side code execution but can be severe if the user logs into privileged accounts while the malicious page is viewed.

WordPress sites that have installed the Gutenify plugin by CodeYatri with any version up to and including 1.5.7 are affected. All WordPress installations that have activated the plugin and allow content submission through its interface fall under this scope.

The CVSS score of 7.1 indicates a high level of risk, yet the EPSS score of less than 1% suggests that exploitation is currently unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker submitting content or configuration via the plugin’s administrative interface, which is then rendered to all site visitors. Successful exploitation requires the plugin to be active and an entry point to be exploited by an authenticated or otherwise privileged user.