Improper neutralization of user input during web page generation allows an attacker to store malicious script code within WordPress pages. The stored XSS can be triggered when a user views the affected page, potentially enabling session hijacking, phishing, cookie theft, or defacement of the site. The weakness is a classic input‑validation flaw, classified as CWE‑79.

The vulnerability affects the Anshul Gangrade Custom Background Changer plugin for WordPress, specifically all releases from the earliest version through version 3.0. Users running any of these plugin versions are at risk unless the plugin is updated to a fixed release or removed.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests that current exploitation activity is rare. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker submitting a crafted value through the WordPress administrative interface that the plugin stores and later renders on a page. Based on the description, it is inferred that this requires administrative access to change the background setting.