This vulnerability arises from improper neutralization of user-supplied input generated by Glen Scott’s Plugin Security Scanner. The flaw permits attackers to store malicious JavaScript in the plugin’s data handling functions, which is then rendered on web pages viewed by other users. Stored XSS enables the attacker to hijack user sessions, deface sites, or launch phishing attacks without further action beyond the initial injection.

All installations of the Plugin Security Scanner plugin from any earlier version through 2.0.2 are affected. The product is offered by Glen Scott and used in WordPress environments.

The CVSS score of 5.9 indicates a moderate severity level. With an EPSS score of less than 1% the likelihood of exploitation is low but not zero, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by submitting malicious input through the plugin’s interface, which is then stored and later rendered for site visitors. As the issue resides in stored data, any authenticated user who can write data to the plugin can carry out the attack.