The issue is an improper neutralization of input during web page generation that allows an attacker to inject malicious JavaScript that is stored and later displayed to users. This stored XSS flaw can execute in the browsers of any visitor who views the affected content, potentially enabling session hijacking, credential theft, or site defacement.

WordPress plugin mshop-naver-talktalk (코드엠샵 소셜톡), any version up to 1.2.2. All installations where that plugin is present are affected.

The CVSS base score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, meaning no known large‑scale exploitation. The stored nature of the XSS means an attacker must first provide malicious input that the plugin stores and later renders, so the attack vector is via user‑submitted data that is not properly sanitized, likely through the plugin’s administrative interface or front‑end forms.