The WP Subtitle plugin contains an improper neutralization of input that allows attackers to store malicious scripts in subtitle fields, which are then rendered when the page is viewed. This flaw enables execution of arbitrary code in users’ browsers, permitting session hijacking, credential theft, site defacement, or delivery of malware. The weakness is categorized as CWE‑79, an input validation issue.

The vulnerability affects installations of the WP Subtitle plugin for WordPress up through version 3.4.1. Any WordPress site that has installed this plugin and has not applied a later patch is exposed.

With a CVSS score of 6.5 the risk level is moderate, and the EPSS score of less than 1 % indicates that the likelihood of public exploitation is currently low. The flaw is not listed in the CISA KEV catalog. Attackers must submit malicious subtitle content via an account with permission to edit subtitles or through the administrative interface. Once the data is stored, it can be triggered simply by a page view, giving the attacker persistent access through unsuspecting users.