The vulnerability exists in the SiteOrigin Widgets Bundle plugin for WordPress and arises from the unsanitized use of the data-url DOM Element Attribute. An attacker who has Contributor, Editor, or higher access can embed custom JavaScript into pages. When any user loads the affected page, the injected script runs with that user’s context, potentially hijacking sessions, stealing credentials, or redirecting traffic. The flaw is a classic Stored XSS (CWE‑79) that allows persistent code execution across visits.

WordPress sites running the SiteOrigin Widgets Bundle plugin with versions 1.68.4 or earlier. The plugin is installed by the SiteOrigin vendor and is distributed through the WordPress plugin repository.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. The attacker must possess Contributor-level role or higher and be able to edit page content. The injection occurs via the data-url attribute, so achieving the attack requires both authenticated access and the ability to modify or create widget configurations. Once placed, the script will execute for all visitors of the affected page.