The CVE is a stored XSS flaw in the Rencontre plugin by Jacques Malgrange. The weakness in the plugin's input handling allows attacker‑controlled scripts to be written to a data store and then rendered in a web page without proper escaping, as identified by CWE-79. An attacker who can submit content to the vulnerable input field can inject JavaScript that would execute in the browsers of any user who views the affected page, potentially resulting in credential theft, session hijacking or defacement of the site.

The vulnerability affects the Rencontre WordPress plugin for all versions up to and including 3.13.7. Users running any iteration of the plugin within that range are impacted. There is no indication of an affected WordPress core release, so the risk is confined to this third‑party plugin.

The CVSS score of 5.9 classifies the flaw as moderate. The EPSS score of less than 1% indicates that, at the time of analysis, observed exploitation likelihood is very low, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is through the plugin’s data‑entry interfaces, so an attacker would need to be able to submit or influence content that is stored and later rendered. Careful monitoring of the plugin’s input points and the web application’s overall request handling should reduce the observation window for exploitation.