The Document Engine plugin for WordPress accepts user input that is displayed on webpages without proper escaping, leading to a stored cross‑site scripting vulnerability. Once exploited an attacker can inject malicious script that is served to all users viewing the affected content, potentially hijacking sessions, defacing the site or redirecting users to phishing pages. The weakness is classified as CWE‑79.

The flaw affects the MatrixAddons Document Engine plugin as bundled in WordPress installations. All releases up to and including 1.2 are vulnerable; versions prior to 1.0 are also impacted by the lack of proper input sanitization. Users running these versions on any WordPress site are at risk.

The CVSS v3 score for this vulnerability is 6.5, indicating moderate severity for a stored XSS. The EPSS score is below 1 %, suggesting low likelihood of recent exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web interface where an attacker submits data through the plugin’s input forms that is later rendered to the page. The attacker does not need administrative privileges, so a standard user or compromised account may be sufficient to inject malicious content.