Improper neutralization of user input during web page generation in the WP Github Gist plugin allows stored cross‑site scripting. A malicious actor can inject crafted code into input fields that the plugin stores and subsequently renders within pages, enabling the execution of arbitrary scripts when other users view those pages. This can lead to cookie theft, session hijacking, or site defacement.

WordPress installations running the WP Github Gist plugin version 0.5 or earlier, authored by Sudar Muthu. The CVE description lists the vulnerability as affecting "from n/a through <= 0.5," meaning any disclosed version up to and including 0.5 is impacted.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. The EPSS score is reported as less than 1 %, suggesting low but non‑zero exploitation probability. The issue is not listed in the CISA KEV catalog, reducing its known exploitation visibility. Attackers could exploit the flaw by submitting malicious input via the plugin’s interface, which is stored and rendered to other site users without proper sanitization. As a stored XSS, the vulnerability persists across sessions and does not require a complex attack chain.