The WP Proposals plugin accepts user‑supplied input that is stored and later rendered inside web pages without adequate escaping. This flaw permits a malicious actor to embed JavaScript, which is executed in the browsers of visitors to the site, potentially leading to cross‑site scripting attacks. The impact includes theft of session cookies, credential hijacking, defacement of content, and execution of arbitrary actions on behalf of the user. The vulnerability is classified as CWE‑79 and provides a stored attack vector, meaning the malicious payload persists until the affected content is viewed.

WordPress sites that have the WP Proposals plugin by WP CodeUs installed, version 2.3 or earlier. The plugin’s data forms and stored content are the primary vectors for exploitation.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests a low likelihood of active exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack path involves submitting crafted input through the plugin’s forms (either via the front‑end or the admin interface) which is then displayed in subsequent page loads, allowing an attacker to execute arbitrary client‑side scripts.