The WP Category Dropdown plugin stores user‑provided input directly into an HTML page without proper escaping, creating a stored XSS vulnerability. An attacker who can supply content that the plugin later renders can inject malicious JavaScript that executes in the browsers of visitors who view the affected page. This flaw corresponds to CWE‑79 and allows client‑side code execution whenever the compromised content is displayed.

All installations of Chandrika Sista’s WP Category Dropdown plugin with a version of 1.9 or earlier are vulnerable. WordPress sites that have not updated the plugin since it reached 1.9 remain at risk.

The CVSS score of 6.5 indicates a moderate overall severity. The EPSS score of less than 1 % signals a low probability of exploitation at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is the plugin’s content‑input interface; it is inferred that a user with permission to create or edit dropdown entries could supply the malicious payload. Successful exploitation would affect anyone who views the rendered page unless additional defenses are in place.