The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject malicious scripts into content managed by the Rey Core plugin. When such content is rendered on a page, the payload runs in the context of the site, potentially enabling defacement, session hijacking, or the delivery of further malware. The flaw is classified as CWE‑79 and can affect the confidentiality, integrity, and availability of the affected website.

Affected systems include WordPress sites that have the ReyCore plugin (ReyCommerce Rey Core) installed with a version of 3.1.8 or earlier. The plugin is responsible for rendering user‑generated content, so the impact is limited to sites running the vulnerable version of this plugin.

The CVSS score of 6.5 indicates a moderate level of severity. The EPSS score of less than 1% suggests exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw allows arbitrary script execution on stored content, an attacker with the ability to submit or edit content can exploit it remotely through the plugin’s input fields. The attack requires access to the plugin’s content entry interface but does not need privileged credentials if the site permits content authors to edit pages.