Improper neutralization of user-controlled input during web page generation enables an attacker to inject malicious script code that is stored and served to users. This vulnerability is a stored XSS flaw classified as CWE-79, which can be exploited to steal user session data, deface the site, or deliver malware via the compromised page. The risk includes significant confidentiality and integrity impacts for visitors accessing the affected WordPress site.

The issue affects the webnique USERCENTRICS CMP plugin, known as the Usercentrics Consent Management Platform. Versions from unknown through 1.0.9 are vulnerable. The plugin is commonly installed on WordPress sites to manage cookie consent and privacy notices.

With a CVSS score of 5.9 the flaw is considered moderately high severity. The EPSS score of less than 1% indicates that active exploitation is unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. Inferred from the description, the attack vector is a stored XSS that requires an authenticated author who can submit content to the plugin; a successful exploit would allow an attacker to inject scripts that run in the browsers of any user who views the affected page.