This vulnerability is a stored cross‑site scripting flaw caused by improper neutralization of user input during web page generation. An attacker can inject malicious scripts that are then rendered by the plugin for any user viewing the affected feed. The consequence is that a victim’s browser will execute attacker‑controlled code, potentially leading to session hijacking, data theft, defacement, or other client‑side attacks. The weakness is identified as CWE‑79. The plugin stores the malicious payload, so the impact is local to the WordPress site and affects every user who has the feed displayed.

The SAPO Feed plugin for WordPress, versions up to and including 2.4.2, is impacted. Any WordPress installation that uses this plugin and has not been updated beyond version 2.4.2 is potentially vulnerable.

The CVSS score of 5.9 classifies the vulnerability as medium severity. The EPSS score of less than 1 % indicates a very low expected exploitation probability at present. The vulnerability is not listed in the CISA KEV catalogue. Based on the description, the likely attack vector is via the plugin’s input handling—an attacker can supply malicious data that is stored and later rendered to users. Exploitation would require the attacker to submit the payload to the feed, which can be done if the plugin allows user data submission or content authoring. Once stored, any visitor to the affected feed experiences the injected script.