The vulnerability is an insufficient neutralization of input during web page generation, giving rise to a stored cross‑site scripting flaw in the SiteNarrator Text-to‑Speech Widget plugin. The flaw allows malicious JavaScript to be stored by the plugin and later executed when any user loads a page that includes the injected content, potentially leading to cookie theft, session hijacking, defacement, or arbitrary client‑side actions.

All released versions of Ken107’s SiteNarrator Text-to‑Speech Widget for WordPress up to and including version 1.9 are affected. Site administrators who can input content into the plugin’s fields are at risk of inadvertently storing malicious code that will be rendered for site visitors.

The CVSS score of 5.9 categorizes the vulnerability as moderate. An EPSS score of less than 1% indicates a low probability of exploitation at present, and the flaw is not listed in the CISA KEV catalog. Based on the vulnerability description, it is inferred that an attacker could exploit the stored XSS by submitting malicious payloads through the plugin’s input interface; the payload is then persisted and delivered to all visitors of the affected site, causing client‑side compromise.