The vulnerability is a stored cross‑site scripting flaw arising from improper neutralization of user input within the WordPress Stockholm Core plugin through version 2.4.6. Attackers can inject malicious JavaScript that persists in plugin‑generated content and is later delivered to any site visitor, allowing potential cookie theft, defacement, or other client‑side attacks. The weakness aligns with CWE‑79 – Improper Neutralization of Input.

The affected product is the Select‑Themes Stockholm Core plugin for WordPress. All releases up to and including version 2.4.6 are vulnerable; any site deploying a version from the earliest release through 2.4.6 without upgrading remains at risk.

The CVSS score of 6.5 denotes moderate severity, while the EPSS score of less than 1% indicates a low current exploitation probability, and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector involves submitting malicious content through the plugin’s input interface, which the plugin stores and later outputs without proper sanitization. Once injected, the payload executes in the browsers of any user who views the affected page, potentially affecting all site visitors.