Vulnerability allows stored cross‑site scripting due to improper neutralization of input during web page generation. An attacker can inject malicious script that will execute in a victim’s browser when the affected plugin displays the stored content, leading to arbitrary JavaScript execution with the victim’s privileges, enabling session hijacking, data theft, or defacement. The weakness is identified as CWE‑79.

Aum Watcharapon’s Designil PDPA Thailand plugin for WordPress, versions up to and including 2.0.1, is affected. Any WordPress site running these plugin versions is at risk.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% points to a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker exploiting a weakness in the plugin’s input handling—such as through a form or settings page—to store malicious script that is later rendered to users. Based on the description, it is inferred that the attacker may need the ability to submit content to the vulnerable plugin, which typically requires administrative privileges or access to a form. Therefore, while the risk is moderate, the opportunity for exploitation is relatively low given current metrics.