The vulnerability is an improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that are stored and executed whenever the content is viewed. If exploited, a stored XSS could lead to defacement, theft of cookies, session hijacking, or execution of arbitrary actions in the context of the logged‑in user, as described by CWE‑79.

The Crocoblock JetPopup plugin for WordPress, versions from the initial release through 2.0.15.1, is affected. Any WordPress site that has this plugin installed and not upgraded beyond 2.0.15.1 is potentially vulnerable.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require the attacker to supply malicious input via the plugin’s content fields or admin interface, after which the script runs automatically for any user who views the affected content.