The vulnerability arises from improper neutralization of user-supplied input during HTML generation in the CodeSolz Better Find and Replace plugin for WordPress. The flaw allows attackers to embed malicious script code that is stored in site content and rendered in subsequent page views. This stored XSS could be used to steal user credentials, execute malicious actions on behalf of site visitors, or deface the site.

CodeSolz Better Find and Replace plugin, installed on WordPress sites, versions from unknown through 1.7.6 inclusive.

CVSS base score 5.9 indicates moderate potential impact. The EPSS score is below 1% suggesting a low likelihood of exploitation in the short term, and the vulnerability is not listed in the CISA KEV catalogue. Attackers would typically need access to the plugin's administrative interface to inject malicious content, making the attack vector administrative or credential-based. If successful, the XSS could affect all users who visit the impacted pages.