The vulnerability arises from improper neutralization of user-supplied input during web page generation, enabling stored cross‑site scripting (XSS). A malicious actor can inject JavaScript that is later served to other site visitors, potentially compromising session cookies, defacing the site, or deflecting users to malicious resources. The weakness is classified as CWE‑79, indicating an input validation flaw that allows reflected and stored attacker-controlled content to be executed in the victim’s browser.

The issue affects the Saad Iqbal myCred WordPress plugin for all versions up to and including 2.9.4.3. Users running any older or unpatched instance of myCred on a WordPress site are therefore vulnerable.

The CVSS score of 6.5 marks the flaw as moderate in severity, while an EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to inject malicious content into a field that the plugin stores and later displays; the likely attack vector is a stored XSS via user input such as comments or custom fields. If such a vector is available, an attacker could execute arbitrary code in the victim’s browser context.