An improper neutralization of input during web page generation leads to a stored XSS vulnerability in the WBC907 Core plugin. The flaw allows attackers to inject malicious scripts that persist in the database and are executed in the browsers of users who view affected pages, potentially compromising user data or hijacking sessions. The weakness is a classic CWE‑79 Cross‑Site Scripting scenario. The likely attack vector is through any input field in the plugin that accepts user data and stores it without sanitization.

WordPress WBC907 Core plugin, versions up to and including 3.4.1 are affected. The vulnerability applies to all installed versions of the plugin from the earliest available release through the 3.4.1 version.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is considered unlikely, and the vulnerability is not currently listed in the CISA KEV catalog. Nonetheless, because stored XSS can impact all users who view the compromised content, the risk is non‑negligible for sites still running a vulnerable version of the plugin. Attackers can achieve widespread impact by inserting malicious code that is executed in every user’s browser that loads the affected page.