The flaw is an improper neutralization of input during web page generation in the Exchange Rates plugin, allowing attackers to inject and store malicious scripts in pages viewed by other users. This stored Cross‑Site Scripting can execute within the victim’s browser, potentially yielding session hijacking, credential theft, defacement, or the delivery of additional malicious payloads. The weakness is a classic input validation failure, identified as CWE‑79.

The vulnerability affects the falselight Exchange Rates WordPress plugin in all releases up to and including version 1.2.5. Sites that have not upgraded beyond 1.2.5 are vulnerable.

The CVSS score of 6.5 reflects a moderate risk, and the EPSS score of less than 1% indicates a low likelihood of known exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web interface that accepts user input—an attacker can submit a crafted value that the plugin later stores and serves to other visitors, resulting in script execution in their browsers. Proper mitigation involves applying the vendor’s patch or otherwise preventing the injection of untrusted data into page output.