The Wappointment plugin stores unfiltered user input directly into the database and later displays it on web pages without proper neutralization, resulting in a stored XSS flaw. A malicious actor can submit crafted JavaScript through any input field that the plugin accepts, and the code will execute in the browsers of any user who views the affected content. This could allow attackers to hijack sessions, deface the site, or steal credentials, impacting confidentiality, integrity, and availability for site visitors.

Any WordPress installation that has the Wappointment plugin installed with a version equal to or older than 2.6.9 is affected. The vulnerability applies across all environments where the plugin is loaded, regardless of hosting provider or site configuration.

The CVSS score of 6.5 indicates a moderate severity, but the EPSS score of less than 1% suggests that exploitation attempts are currently extremely unlikely. The issue is not yet listed in the CISA KEV catalog. Attackers would likely craft malicious input via exposed plugin forms; the path requires the attacker to have write access to the plugin’s input mechanisms, but no privileged or elevated rights. Once the payload is stored, it affects all users who view the contaminated page.