An improper neutralization of user input in the Simasicher SimaCookie plugin allows attackers to inject malicious scripts that are stored and served to visitors of a WordPress site. If an attacker controls content that the plugin stores, the injected script runs in the browsers of other users, potentially stealing session cookies, defacing the site or redirecting users to malicious pages. This vulnerability can compromise the confidentiality and integrity of user data and allow attackers to impersonate legitimate users during their visit.

The flaw affects the Simasicher SimaCookie plugin for WordPress, in all released versions up to and including 1.3.2. Any WordPress installation that has this plugin installed and enabled is susceptible until the plugin is upgraded beyond version 1.3.2.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers would need to supply malicious content to the plugin’s storage mechanism, typically via an administrative or content‑authoring interface, and the victim must visit the affected page with a web browser that executes the injected script.