The vulnerability is a stored cross‑site scripting flaw (CWE‑79) that permits an attacker to persist malicious scripts in user‑controlled content. When a victim visits a page that renders the compromised content, the script runs with the victim's privileges, enabling theft of session cookies, redirection to phishing sites, or other malicious interactions.

The flaw is present in the WP Microdata WordPress plugin distributed by tormorten. All versions up to and including 1.0 are affected; newer releases contain a fix that is not detailed in the publicly available information.

The CVSS base score is 6.5, indicating moderate severity, and the EPSS score is below 1 %, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and there are no publicly known exploits. An attacker would need to craft malicious input that the plugin stores and later displays, implying that the attack surface exists only where the plugin is active and accepts user input.