This vulnerability allows a malicious actor to insert arbitrary JavaScript into a WordPress site that is later executed in the browsers of visitors. The stored XSS flaw enables code execution in the victim’s context, facilitating further attacks such as cookie theft, session hijacking or phishing attempts. The weakness is a classic “Improper Neutralization of Input During Web Page Generation” flaw, classified as CWE‑79.

The FW Anker plugin for WordPress, developed by Franz Wieser, is affected for all releases up to and including version 1.2.6. Sites running any of these versions are vulnerable and can inject malicious scripts via the plugin’s input fields.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. It is not listed in the CISA KEV catalog. The likely attack path involves exploitation of the web form that accepts user input and stores it without proper escaping; a threat actor would need to submit malicious payloads that remain on the site until a victim loads the affected page.