The vulnerability arises from improper input neutralization during web page generation, enabling stored cross‑site scripting attacks. An attacker can inject malicious JavaScript that is persisted in the site’s content and executed whenever any user loads a page rendered by the plugin. This can lead to credential theft, session hijacking, defacement or compromise of other visitors, directly impacting the confidentiality and integrity of site data.

The issue affects the WordPress SEO Search Permalink plugin from Terry L. for all releases through version 1.0.3. The plugin is commonly used to generate SEO‑friendly permalinks, and any site that has installed or upgraded to this version is potentially vulnerable.

The CVSS score of 5.9 indicates moderate quality of exploitability and impact, while an EPSS score of less than 1% suggests low observed exploitation probability at this time. The vulnerability is not present in CISA’s KEV catalog. The attack vector is inferred to be web‑based, relying on the plugin’s data storage and rendering mechanisms to persist injected code.