The vulnerability is a stored input‑validation flaw (CWE‑79) that permits an attacker to inject malicious script into the WordPress site through the Simple Matomo Tracking Code plugin. Once stored, the script is rendered in users’ browsers, potentially enabling session hijacking, cookie theft, or other client‑side attacks. The impact is limited to client‑side compromise unless the injected script in turn accesses privileged data or triggers further server‑side exploits.

This flaw affects all installations of the rbaer Simple Matomo Tracking Code WordPress plugin in versions n/a through 1.1.0. Users of any WordPress site running these plugin versions are at risk, regardless of site ownership or configuration level.

With a CVSS score of 5.9 the vulnerability is classified as medium and the EPSS score of under 1% suggests a low probability of exploitation at this time; the vulnerability is not in the CISA KEV catalog. In practice, a likely attack vector would involve an attacker with sufficient privileges to add or modify plugin settings, since the stored XSS originates from data persisted in the plugin. Exploitation would then affect all visitors to the affected site.