Improper neutralization of script‑related HTML tags in the Norebro Extra plugin allows an attacker to inject script code into web pages viewed by other users. The vulnerability is a basic cross‑site scripting flaw that could enable the attacker to run arbitrary JavaScript, steal session cookies, deface content, or redirect users to malicious sites. The impact is limited to the scope of the compromised web interface and affected users who view the injected content.

The vulnerability affects the WordPress Norebro Extra plugin distributed by colabrio for all versions up to and including 1.6.8. Users of WordPress sites hosting this plugin are at risk if no further actions are taken.

The CVSS score of 5.3 indicates a medium level of severity, while the EPSS score of less than 1% signals a very low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. The attack vector is the web interface that accepts user‑supplied input; based on the description, it is inferred that the attacker must submit content, likely through theme options or custom widget settings, to trigger the vulnerability. Once executed, the impact is confined to victims who view the affected page.