Improper neutralization of input during web page generation allows attackers to store malicious scripts in the Space Studio Click & Tweet plugin, leading to stored Cross‑site Scripting. An attacker could craft payloads that are persisted by the plugin and then trigger execution when a victim views or interacts with the affected content, potentially compromising the victim’s browser session, leaking credentials, or defacing the site.

Space Studio Click & Tweet plugin, versions n/a through 0.8.9, are affected. All instances of the plugin installed at or below version 0.8.9 are vulnerable.

The CVSS score of 5.9 indicates a medium severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the current environment. The vulnerability is not listed in CISA’s KEV catalog. Likely exploitation requires an attacker to submit data to the plugin that is stored and later rendered in a user’s browser. Successful exploitation would allow script execution in the context of the site, enabling data theft or site defacement.