The vulnerability allows a stored cross‑site scripting (XSS) flaw due to improper neutralization of input during web page generation (CWE‑79). Attacking user input can be injected into the DOAJ Export plugin, where it is subsequently rendered on the site without adequate sanitization. This allows an attacker to deliver malicious scripts that execute in the browsers of site visitors, potentially compromising credentials, session data, or defacing the site.

WordPress installations that have the Jonathan Brinley DOAJ Export plugin version 1.0.4 or earlier are affected. Sites using any earlier releases of the plugin are also vulnerable. No other WordPress components are mentioned.

The CVSS score of 5.9 signals moderate severity with potential for moderate impact on confidentiality, integrity, and availability. The EPSS score of fewer than 1 % indicates a very low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through malicious input submitted via the plugin’s user interface, which is stored and later rendered on the site. If an attacker can inject code, it will run in the context of any user who views the affected page.