The vulnerability is an Improper Neutralization of Input During Web Page Generation, allowing attackers to inject malicious scripts that are displayed to other users when the plugin renders stored data. This Stored XSS can lead to client‑side attacks such as cookie theft, session hijacking, or defacement of the site. The weakness corresponds to CWE‑79.

The issue affects the POSIMYTH UiChemy WordPress plugin through versions 4.4.2 and earlier. Any WordPress site that has installed one of these affected plugin versions is vulnerable.

The CVSS score of 5.9 indicates moderate severity, but the EPSS score of <1% signifies a very low overall likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely via the plugin’s input forms, where attackers supply malicious content that the plugin stores in the database and later displays unfiltered to other site visitors. Successful exploitation therefore requires that the vulnerable plugin is active, improperly sanitizes user input, and serves the stored data to other users who are susceptible to client‑side attacks such as cookie theft, session hijacking, or defacement.