The WP Last Modified Info plugin contains an improper neutralization of input during web page generation, enabling a stored XSS flaw where malicious JavaScript can be injected and later rendered to site visitors. This can lead to session hijacking, defacement, or arbitrary script execution on the website, impacting the confidentiality, integrity, and user experience.

WordPress sites that have the WP Last Modified Info plugin version 1.9.2 or earlier, developed by Sayan Datta, are affected. The flaw exists in all releases from the earliest public version up through 1.9.2.

This vulnerability has a CVSS score of 6.5, indicating moderate risk. The EPSS score of less than 1% suggests a low probability of exploitation at present, and it is not listed in the CISA KEV catalog. The attack vector is through the plugin’s handling of user‑supplied content; based on the description, it is inferred that an attacker must possess privileges sufficient to submit or edit content that routes through the plugin’s insecure logic, but such privileges are typically available to authenticated users with content‑creation rights.