The vulnerability, which is identified as CWE‑79, is an improper neutralization of input that allows attackers to inject malicious script into web pages rendered by the Series plugin. Stored XSS means the malicious payload can be persisted in the database and served to any user who views the affected pages. Based on the description, it is inferred that attackers would need to have roles that can add or edit Series content—typically author or higher—to inject the code. An attacker could steal session cookies, deface content, or impersonate other users, compromising confidentiality and integrity of the site.

The Series plugin developed by Justin Tadlock, versions up to and including 2.0.1, is affected. Any WordPress installation using Series 2.0.1 or earlier may be vulnerable; newer versions are not mentioned as impacted.

The CVSS score of 6.5 denotes a moderate risk. The EPSS score is below 1 %, indicating very low probability of observed exploit, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to deliver a payload via the plugin’s input fields or content editor, which is accessible to users with author or higher roles. If they gain such access, the stored script will run in the browsers of all visitors to the affected content.