The vulnerability allows an attacker to inject malicious scripts that are rendered when the web page is generated, leading to stored XSS. Because the input is not properly neutralized, the attacker receives persistent access to script execution on pages viewed by other users. This can compromise confidentiality, integrity, and availability by facilitating session hijacking, defacement, or the spread of malware.

The WordPress plugin emarket-design Request a Quote is affected in all releases up to and including version 2.5.0. Any WordPress site that has not upgraded beyond this version may be vulnerable.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low immediate exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is the plugin’s data entry interface, which accepts user input and stores it unfiltered; an attacker must submit malicious input through the plugin’s interface. The stored payload then executes in the browsers of any visitor to the affected page. The impact would be confined to users who load the compromised page, but it is possible to affect the entire audience of the website.