This vulnerability allows stored cross‑site scripting through improper input neutralization in the TempTool [Show Current Template Info] plugin. A crafted input can be saved to the database and served to users in a generated web page, potentially enabling attacker‑controlled script execution in the context of the site visitor’s browser. The flaw falls under CWE‑79 and could result in session hijacking, data theft, or site defacement.

The issue affects the HappyDevs TempTool [Show Current Template Info] WordPress plugin on all versions up to and including 1.3.1. No other variants are listed as vulnerable.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% shows a very low, but non‑zero, likelihood of exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalog. Based on the description, the most likely attack vector is a reusable script inserted via an administrative input or settings page that will then be rendered to all site visitors. Successful exploitation requires access to the plugin configuration interface or a method to inject data that the plugin stores and later displays.