The vulnerability is an instance of improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that are stored and served to all visitors. The stored XSS can execute arbitrary JavaScript within the context of the website, potentially enabling session hijacking, defacement, or the execution of malicious payloads. The weakness aligns with CWE‑79, where a lack of output encoding permits injection of executable code.

This flaw exists in the WordPress Notely plugin provided by Rocket Apps, specifically for versions n/a through 1.8.0. Users running any of those releases are susceptible, regardless of the WordPress core version. The vulnerability is tied to the plugin’s handling of user‑supplied content that is displayed on the site.

The CVSS score of 5.9 indicates medium severity for this stored XSS flaw. The EPSS score is below 1%, suggesting a very low probability of widespread exploitation at present. The vulnerability is not listed in CISA's KEV catalog. Based on the description that the issue allows Stored XSS in Notely versions up to 1.8.0, the likely attack path involves an attacker injecting malicious content through the plugin’s input fields, which is subsequently rendered on pages that visitors load. This inference is drawn directly from the stated vulnerability type; the CVE data does not specify additional prerequisites or constraints, so the attack vector is inferred to be via user‑controlled input that is displayed. Successful exploitation could lead to session hijacking or arbitrary script execution for any user who views the affected content.