The vulnerability is a stored cross‑site scripting flaw caused by improper neutralization of user input during web page generation. An attacker can inject malicious JavaScript that will execute in the browsers of any user who views the compromised page, potentially allowing the theft of credentials, session hijacking or defacement. The weakness is a classic XSS flaw (CWE‑79).

The flaw affects the Magento 2 WordPress Integration plugin, with versions from the first release up to and including 1.4.2.1, sold by Modern Minds. Only these plugin releases carry the vulnerability; newer minor releases are presumed fixed.

The CVSS v3.1 score of 5.9 indicates a moderate severity. The EPSS score of less than 1 % shows a very low exploitation probability at the time of analysis, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote; an authenticated or unauthenticated user can submit malicious content through the plugin’s input fields, which is then stored and rendered without proper sanitization. Because the flaw is stored, once data is saved it is served to all visitors, amplifying its impact.