The vulnerability is an improper neutralization of input during web page generation, allowing stored cross‑site scripting in the WordPress Auto Listings plugin in all releases up to 2.7.1. An attacker can inject malicious JavaScript that will run in the browsers of users who view affected listings, potentially leading to data theft, session hijacking, defacement, or other client‑side impacts. The weakness is a classic input‑validation flaw, formally identified as CWE‑79.

Affected systems are installations of the WordPress Auto Listings plugin with version 2.7.1 or earlier. The issue applies to any site that uses the plugin to accept, store, or display listing data without proper sanitization, regardless of plugin configuration or WordPress host.

The CVSS base score is 6.5, indicating moderate severity. The EPSS score is less than 1%, showing a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the plugin’s data entry interface; an attacker who can submit or edit listing content will trigger the stored XSS. No additional privileges beyond the ability to add or modify listing data are required, as inferred from the description that the flaw exists in stored data.