The vulnerability is an Improper Neutralization of Input During Web Page Generation that allows an attacker to store malicious script code in the WH Tweaks plugin data. When a victim visits the affected page, the script is executed in the victim’s browser, enabling the attacker to steal session cookies, deface the site, or launch further attacks against users of the site. The weakness is a classic Stored XSS flaw (CWE‑79).

The WH Tweaks plugin for WordPress, released by webheadcoder, is affected in all versions up through 1.0.2. WordPress sites that still run this version of the plugin are vulnerable.

The CVSS score of 5.9 classifies the issue as moderate severity. The EPSS score of less than 1% indicates that the exploitation probability is very low as of the latest data. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. Based on the description, it is inferred that a user with write access to the plugin’s configuration or content editing area could inject the malicious payload; an authenticated attacker may exploit the stored script, or an unauthenticated user may trigger it by visiting the site.