This vulnerability permits an attacker to store malicious scripts within the Page‑list plugin, which are subsequently executed in the browsers of users visiting pages generated by the plugin. The impact is the execution of arbitrary JavaScript in the context of the victim’s account, potentially enabling credential theft, defacement, or the installation of malware. The weakness is a classic web input validation flaw, classified as CWE‑79.

The WordPress Page‑list plugin from webvitaly is affected in all versions up to and including 5.8. The vulnerability exists regardless of the specific WordPress installation or site configuration.

The CVSS base score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation at this time, and the flaw is not listed in the CISA KEV catalog. Attackers would need an ability to submit or edit content that the Page‑list plugin accepts, likely via administrative or content‑author privileges; the attack vector is stored XSS with no user interaction required beyond normal page rendering.