The vulnerability is a stored Cross‑Site Scripting flaw that allows an attacker to embed malicious script into the web page output of sites using the Sitekit plugin. Because the input is not properly neutralized, any script injected through the plugin can execute in the context of the victim’s browser, potentially enabling credential theft, session hijacking, or defacement when other users view the affected content. The weakness is classified as CWE‑79, a classic unescaped output issue.

Any WordPress installation that has Sitekit v2.0 or earlier installed is affected. The vulnerability applies to all versions from the earliest available release up to and including 2.0, as the plugin fails to sanitize user input during page rendering.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests that, while the vulnerability exists, the likelihood of real‑world exploitation is low at this time. The vulnerability is not currently listed in CISA’s KEV catalog. Attackers would typically abuse the plugin’s content entry features to inject malicious JavaScript, which is then stored and served to any user who visits the page. The required conditions are that the attacker can submit content via the plugin, and that affected users view the stored content.