This vulnerability arises from improper neutralization of user input when generating web pages, enabling a stored cross‑site scripting (XSS) flaw in ONTRAPORT’s PilotPress WordPress plugin. Attackers can inject arbitrary JavaScript code that is then executed in the browsers of visitors to pages that render data from the plugin. The injected script can steal session cookies, deface content, or facilitate further phishing attacks, compromising the confidentiality and integrity of user sessions and potentially the website’s displayed content.

The flaw affects all installations of PilotPress on WordPress up to version 2.0.36. The affected product is the PilotPress plugin developed by Ontraport. Site owners running an affected version are exposed, regardless of the size of their audience.

The CVSS base score of 6.5 indicates a moderate severity risk. The EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation at this time. However, stored XSS remains a classic vector for attackers, especially when user‑supplied content is rendered without proper sanitization. An attacker could provoke vulnerable users or target any page that incorporates PilotPress content, potentially hijacking their sessions or injecting malicious scripts.