Improper neutralization of user input during web page generation in the xnau webdesign Participants Database plugin creates a stored cross‑site scripting vulnerability. When an attacker submits data that is later rendered on a page, malicious JavaScript can be executed in the browsers of any user who views that page. Based on the description, the attack could allow the attacker to steal session cookies, hijack user sessions, deface the site’s content, or redirect users to fraudulent sites, although the exact post‑exploitation capabilities are not detailed in the advisory.

The flaw exists in the Participants Database plugin for WordPress released by xnau webdesign and applies to all versions from the earliest available through version 2.7.6.3.

The CVSS score of 6.5 categorises the risk as moderate, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers would most likely deliver the malicious payload via a remote web interface that accepts user‑supplied data, and any visitor who loads the compromised page would be impacted.