The vulnerability is a stored cross‑site scripting flaw that allows an attacker to embed malicious script code into web pages generated by the Themify Popup plugin. This flaw is an instance of improper input neutralization (CWE‑79) and can be used to steal user credentials, hijack sessions, or deliver malware to any visitor that loads the impacted page.

The affected product is the Themify Popup plugin from the vendor themifyme. Versions up to and including 1.4.2 are vulnerable. No other versions are listed as affected.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via the plugin’s configuration or content input fields, where an authenticated or unauthenticated user with write permissions could inject script that is stored in the database and later rendered on client browsers. Emergency vendors recommend applying a patch as soon as one is available; otherwise, the risk remains moderate due to the potential impact on confidentiality and integrity of user sessions.