The akdevs Genealogical Tree WordPress plugin contains a flaw where user input is not properly neutralized before being rendered on a page. This improper input handling allows attackers to store arbitrary script code in the plugin’s data fields, which will be executed in the browsers of visitors who view the affected content. The resulting stored cross‑site scripting can lead to data theft, session hijacking, or defacement of the site.

The vulnerable product is the Genealogical Tree WordPress plugin developed by akdevs. All releases up to and including version 2.2.7 are affected; no specific patch version is listed in the data.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests that active exploitation is currently unlikely. The vulnerability is listed as not in the CISA KEV catalog. The likely attack vector involves an actor who can insert or modify content within the plugin, as stored XSS requires the malicious payload to be saved and later rendered to visitors. This inference is drawn from the description of stored XSS and typical plugin content creation capabilities.