The vulnerability is an improper neutralization of input during web page generation, allowing attackers to store malicious script payloads that will later be executed in the browsers of site visitors. This stored cross‑site scripting flaw enables an attacker to run arbitrary JavaScript in the context of the site, potentially compromising user credentials, defacing the site, or redirecting traffic. The weakness is classified as CWE‑79.

The affected product is the WordPress Add Custom Codes plugin developed by SaifuMak. All releases up to and including version 4.80 – including all earlier, unspecified releases – are vulnerable. Sites running these plugin versions are at risk when the plugin’s custom code features are enabled.

The CVSS score of 5.9 indicates moderate severity. The EPSS score is less than 1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is a typical web application flaw: an attacker can submit malicious script via the plugin’s stored code interface, which the plugin later renders without proper sanitization. Exploitation requires no special conditions beyond normal access to the plugin’s input mechanisms, so any site using the vulnerable plugin version can be targeted.