Improper neutralization of user input in the Bootstrap Modals plugin causes stored XSS, allowing an attacker to inject malicious script into modal content that is served to other users. Such script canack sessions, steal credentials, or exfiltrate data when the modal is rendered, representing a classic CWE‑79 weakness.

The vulnerability affects Neilgee’s Bootstrap Modals plugin for all versions from the first release through 1.3.2. Any WordPress site running the plugin at 1.3.2 or earlier is impacted.

The CVSS score of 6.5 indicates a moderate risk, while the EPSS score of <1% suggests a low probability of exploitation at present. The plugin is not listed in CISA’s KEV catalog. Attackers are likely to exploit the flaw via the plugin’s data‑entry interface, requiring an authenticated user with permission to create or edit modal content. The risk remains moderate due to potential widespread impact if the plugin is employed by many sites, but the low exploitation probability limits immediate threat.