Improper neutralization of user input in the LC Wizard plugin allows attackers to inject malicious scripts that are stored within the site’s content. When other users view the affected pages, the browser executes the injected code, potentially leading to session hijacking, defacement, or data theft. The weakness is a classic input validation flaw identified as CWE‑79.

The vulnerability affects WordPress sites that have the LC Wizard plugin (developed by Niaj Morshed) installed. All released versions up to and including 2.2.4 are impacted. Users running earlier unreleased versions are assumed to be affected if the code lineage is unchanged.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack path involves authenticated or unauthenticated access to the plugin’s content entry points, where malicious payloads can be stored and later served to other site visitors.