This vulnerability allows an attacker to inject arbitrary HTML or JavaScript into WordPress content via the Auros Core plugin's content fields without authentication. As a result, a visitor to the compromised site could execute client‑side code leading to session hijacking, defacement, or tracking. The weakness is rooted in insufficient input validation, as identified by CWE‑80.

The issue affects the Auros Core WordPress plugin version 5.3.1 and earlier, developed by Opal_WP. Any WordPress installation that has the plugin enabled and has not been updated beyond 5.3.1 is vulnerable.

The current CVSS v3.1 score of 5.3 indicates moderate risk. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that broad exploitation activity is not yet documented. Nonetheless, because the plugin processes unsanitized user input and the attack does not require authentication, the threat to sites that rely on Auros Core for content management is significant.