The vulnerability resides in the Comment Form WP – Customize Default Comment Form plugin, where an attacker can inject malicious script code that is then stored and later rendered by the site. This stored XSS flaw allows the attacker to execute arbitrary JavaScript in the context of any site visitor, potentially leading to defacement, credential theft or session hijacking. The weakness is classified as CWE‑79 and is reflected in a CVSS score of 5.9, indicating moderate severity.

WordPress users who have installed the Habibur Rahman Comment Form WP – Customize Default Comment Form plugin, version 2.0.1 or earlier, are affected. All prior releases are included in the impact sphere.

With an EPSS score of less than 1%, the likelihood of an exploit observed in the wild is low, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the flaw can be exploited via the comment submission interface, where any user who can post comments may inject payloads that persist in the database and trigger when normal visitors view the page. The attack vector is inferred to be from the web interface, and the consequences could affect confidentiality, integrity, and availability for all visitors to pages displaying comments.