The vulnerability is an improperly neutralized input during web page generation, allowing an attacker to inject malicious JavaScript that is stored in the plugin's sermon content. This Stored XSS can run in the browsers of any user who views the affected sermon page, potentially enabling session hijacking, defacement, or data theft. The weakness is identified as CWE‑79.

WordPress sites that install the Sermon Manager plugin version 2.30.0 or older are affected. The plugin is developed by wpforchurch and the issue applies to all releases in that range.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the plugin's administrative interface where sermon content is entered, as the stored payload is executed when the content is rendered for any visitor.