The vulnerability occurs when the StellarWP WPComplete WordPress plugin fails to neutralize user input before rendering it in generated web pages, allowing attackers to store malicious scripts. This stored XSS can run in the browsers of any user who views the affected content, potentially leading to session hijacking, defacement, or arbitrary code execution in the browser context. The weakness is defined as CWE‑79, a classic input‑validation flaw.

WordPress sites that run the StellarWP WPComplete plugin version 2.9.5.2 or earlier are susceptible. The issue is present across all affected releases up through 2.9.5.2; newer releases are not affected.

The CVSS score of 6.5 reflects a moderate impact, yet the EPSS score of less than 1% indicates a very low probability of exploitation at present. It is not listed in the CISA KEV catalog. Likely attackers would need to inject the payload via the plugin interface or any user‑submittable field that is stored and rendered by the plugin, and then entice a victim administrator or user to visit the affected page to execute the script.