Stored Cross‑Site Scripting (XSS) arises when the plugin does not neutralize user input used in web page generation. The weakness allows an attacker to persist malicious JavaScript that runs in the browsers of anyone who views the affected page. This can lead to session hijacking, credential theft, defacement, or injection of further malicious code, thereby compromising confidentiality, integrity, and availability of the site content. The vulnerability is classified as CWE‑79.

The vulnerability is present in the WordPress E‑namad & Shamed Logo Manager plugin released by Hamid Reza Yazdani. Any installation of the plugin with a version number of 2.2 or earlier is susceptible. Site owners using WordPress with this plugin should verify the installed version and update if necessary.

With an estimated CVSS score of 5.9 the flaw represents a moderate risk. The EPSS score of less than 1 % indicates that exploitation is currently uncommon, and the vulnerability has not been reported in CISA’s KEV catalog. Nevertheless, a viable attack vector exists through the plugin’s admin interface or any user interface that accepts unsanitized input; an attacker who gains content‑creation privileges could embed malicious script that persists until the content is edited or deleted.