The vulnerability in the Safety Exit WordPress plugin is an improper neutralization of input during web page generation that allows an attacker to store arbitrary script code in the database. When a user visits a page that outputs the stored data, the malicious script runs within the victim’s browser context, potentially enabling session hijacking, cookie theft, or other client‑side attacks. The impact is limited to the web application and the browsers of users who view the affected content, but it can be leveraged for credential theft or defacement.

Tomas Cordero’s Safety Exit plugin for WordPress, versions from the earliest release through 1.8.0, is affected. All installations of the plugin older than 1.8‑1 deploy vulnerable code that echoes unsanitized user input.

The CVSS score of 5.9 indicates a medium severity. The EPSS score of < 1% denotes a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a web‑based input field within the plugin, where an authenticated or guest user can supply data that is stored and later rendered without proper escaping. No additional environmental prerequisites are disclosed in the input data.