The vulnerability is a Stored Cross‑Site Scripting flaw that permits attackers with Contributor‑level access or higher to inject arbitrary scripts through the target parameter of the Plugin README Parser. The scripts are stored and then executed whenever a user loads a page containing the injected content, potentially compromising user accounts and leading to further attack surface expansion. This weakness is classified as CWE‑79, reflecting inadequate input sanitization and output escaping.

The flaw affects the WordPress Plugin README Parser by Morehawes, specifically all releases up to and including version 1.3.15. No other product or vendor versions are currently listed as impacted.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of <1% suggests that widespread exploitation is currently unlikely. Because the issue requires authenticated privilege, an attacker must first obtain a Contributor or higher role in the WordPress site before being able to inject the malicious payload. As the vulnerability is not listed in CISA’s KEV catalog, it is not known to be actively exploited by large‑scale threat actors at this time. The impact remains significant for any users who view the affected pages, but the overall risk to the site is moderate until the fix is applied.