The Stockie Extra WordPress plugin contains a Basic XSS vulnerability due to improper neutralization of script‑related HTML tags, which allows an attacker to inject arbitrary JavaScript into a web page. The flaw arises from the plugin not sanitizing content that may include <script> tags or other executable code. This code injection would execute in the browsers of visitors to the affected site, potentially exposing the site to client‑side exploits.

The vulnerability affects the colabrio Stockie Extra plugin for WordPress versions through 1.2.11 inclusive. Any WordPress site that has installed this plugin on a version equal to or older than 1.2.11 is exposed, regardless of other plugins or themes.

The CVSS base score of 6.5 indicates a moderate rating. The EPSS score of less than 1% suggests a low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to supply malicious input that bypasses the plugin’s lack of sanitization, typically through content fields or administrative interfaces that accept user‑generated data. The impact is limited to the execution of code in the browsers of site visitors.