The vulnerability stems from improper nonce validation on the configuration page of the XiSearch bar WordPress plugin, allowing a forged request to alter settings. An attacker can inject malicious JavaScript that will be persisted in the site’s configuration, leading to stored cross‑site scripting on subsequent page loads. This gives the attacker the ability to execute arbitrary scripts in the context of any visitor, potentially compromising session data, defacing content, or facilitating further attacks.

All installations of the XiSearch bar plugin for WordPress with versions 2.6 and earlier are affected. No specific build numbers exist beyond the "<=2.6" threshold, so any site running a non‑updated instance of this plugin is vulnerable.

The CVSS score of 6.1 indicates a moderate severity. With an EPSS score of less than 1%, exploitation is unlikely but logically feasible; the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated CSRF request that convinces an administrator to click a crafted link, triggering the non‑validated request and inserting the malicious script.