The FancyTabs plugin for WordPress is vulnerable to stored cross‑site scripting due to insufficient input sanitization of the title parameter. When an authenticated user with Contributor or higher permissions supplies malicious content, the plugin stores it unchanged and later renders it on pages, allowing arbitrary JavaScript to execute for any visitor who loads an affected page. The core weakness is a classic CWE‑79 reference‑owasp input/​output handling flaw.

All installations of the FancyTabs plugin authored by GhostToast that use version 1.1.0 or earlier are affected. The CVE description does not provide a specific fixed version for newer releases.

The CVSS score of 6.4 categorizes the problem as a medium‑severity flaw. The EPSS value of less than 1% indicates that current exploitation attempts are unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack requires only an authenticated Contributor‑level account; once an attacker injects a script, it will run in the context of any site visitor, potentially allowing credential theft, defacement, or further exploitation. The primary attack vector is an authenticated web‑application request to the title field, and the impact is confined to the sites where the plugin is enabled.