Improper neutralization of user input during web page generation in the WordPress jinshuju plugin allows stored cross‑site scripting. Script payloads can be injected into the plugin’s data store and executed in the browser of any user who views that page.

All sites running the iamroody 金数据 jinshuju WordPress plugin with a version 1.0 or earlier are vulnerable. This includes any WordPress instance that has the plugin installed, regardless of site role or configuration.

With a CVSS score of 6.5, the vulnerability presents a moderate risk. The EPSS score is below 1 % and the flaw is not included in the CISA KEV catalog. Exploitation requires an attacker with sufficient privileges to submit or edit form data in the plugin so that malicious script can be stored; the actor may then target any visitor to the affected page. Moderate CVSS and low EPSS suggest that widespread exploitation has not yet been observed.