An incorrect filtering of user input during page generation allows an attacker to store malicious scripts within the Opal Service plugin. When these scripts are later rendered to visitors, they can execute arbitrary JavaScript in the context of the site, potentially exposing session data, hijacking user accounts, or defacing the website.

WordPress installations that use the wpopal Opal Service plugin with a version equal to or older than 1.9.1 are affected by this vulnerability.

The vulnerability carries a CVSS score of 6.5, indicating a moderate to high impact if exploited. The EPSS score of less than 1% points to a low probability of exploitation as of the last assessment, and it is not listed in the CISA KEV catalog. The likely attack vector is user-supplied content that the plugin accepts and stores without proper sanitization; the attacker would need to supply such content, either via a public form or an authenticated user submission. Once stored, the malicious script executes automatically for all users who view the affected output.