The vulnerability is an improper neutralization of input during web page generation, which allows attackers to inject malicious scripts that are stored in the plugin’s data and executed in the browsers of other users. Because the plugin accepts unfiltered content, an attacker could embed JavaScript that runs in the context of the site, potentially hijacking user sessions, defacing content, or stealing credentials.

This issue affects the WordPress Highlight and Share plugin, a social text and image sharing extension built by Ronald Huereca, and applies to all installations running version 5.1.1 or earlier.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests the probability of a public exploit is low at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to submit crafted content that the plugin stores without proper sanitization, making exploitation straightforward for anyone with content‑creation privileges. If an attacker succeeds, the injected script executes in the browsers of all visitors who view the affected content, granting the attacker the same privileges as the user whose browser is impacted.