The vulnerability is a stored cross‑site scripting flaw caused by improper neutralization of input during web page generation (CWE‑79). An attacker can inject malicious scripts that are saved in the plugin’s data and later executed in the browsers of users who view the affected content. The CVE description states it is a stored XSS vulnerability but does not detail additional consequences.

WordPress plugin Media Library Assistant by David Lingren, versions up to and including 3.28, is affected. Any WordPress site that installs or uses these plugin versions is vulnerable.

The CVSS score of 5.9 indicates a moderate risk level. Until now the EPSS score is less than 1%, which suggests a low likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to involve users submitting crafted input via the plugin’s media metadata fields, which is then rendered to other site visitors. The stored nature of the XSS means any user who views the affected media content could be exposed to the injected payload.