Curator.io Curator.io curatorio suffers a stored cross‑site scripting (XSS) flaw that allows an attacker to inject malicious scripts into web pages rendered by the plugin. The vulnerability arises from improper neutralization of user‑supplied input during page generation, which is a typical example of CWE‑79. If successful, an attacker could execute arbitrary JavaScript in the browser of any user who views the affected content, leading to credential theft, session hijacking, defacement or further exploitation of the user environment.

The flaw is present in all versions of the Curator.io Curator.io curatorio plugin up to and including version 1.9.5. WordPress sites that have installed this plugin and have not applied a later update are susceptible. No specific WordPress core or PHP version requirement is listed, so the vulnerability can affect any WordPress deployment running a vulnerable plugin.

The CVSS score of 6.5 indicates a moderate severity impact, while the EPSS score of less than 1% suggests a low probability of exploitation as of the last assessment. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector involves injecting malicious content through the plugin’s data entry mechanisms; however this is inferred from the stored XSS nature of the flaw and not explicitly stated in the advisory.