Improper neutralization of input during web page generation in the Append Link on Copy plugin allows attackers to persist malicious scripts that are rendered when users view or copy content processed by the plugin, resulting in cross‑site scripting executed in their browsers.

All WordPress sites that use the JonathanMH Append Link on Copy plugin with version 0.2 or earlier are affected, as the issue applies to every release up to and including 0.2.

The CVSS score of 5.9 indicates medium severity, while the EPSS score of less than 1% reflects a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply malicious content that the plugin stores and later renders; the likely attack vector is through user input that is processed by the plugin before being displayed to site visitors.