The vulnerability is an improper neutralization of input during web page generation, allowing attackers to inject malicious script code. When the data is later rendered, the script executes in the victim’s browser. The risk to confidentiality, integrity, or availability depends on how the script is used, but typical outcomes include defacement, session hijacking, or redirecting users to malicious sites. This weakness is classified as CWE‑79.

Synergy Project Manager, a WordPress plugin developed by cjjparadoxmax, is affected in all releases up to and including version 1.5. Any WordPress installation that has a vulnerable instance of this plugin is at risk.

The CVSS score of 5.8 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that exploitation would involve submitting malicious input through the plugin’s interface, which is then stored and served to other users. Once the malicious code is stored, any subsequent view of the affected page will trigger it, making the attack path straightforward after initial abuse. The vulnerability is easiest to exploit on sites where the plugin accepts user‑generated input without proper sanitization.