Improper neutralization of user‑supplied input in the FireBox plugin allows an attacker to store malicious scripts that are then served to every visitor of affected content.

All WordPress sites that have the FirePlugins FireBox component installed at version 3.1.0‑free or earlier are affected. The bug is tied to how FireBox stores unsanitized input in the database, so any instance of the plugin sending such data to a page will be vulnerable.

The CVSS score of 6.5 classifies the issue as medium severity, while the EPSS score of < 1% indicates a low probability of exploitation at present. The risk is not highlighted in the CISA KEV catalog. Based on the nature of stored XSS, the likely attack vector requires an attacker to have some ability to create or edit content—such as an authenticated editor or administrator—to persist malicious payloads in the database. Once stored, any site visitor can be affected.