The vulnerability permits an authenticated Contributor or higher user to inject arbitrary JavaScript into the slug field, which is stored in the database and rendered without proper sanitization. When any user visits a page with the malicious slug, the injected script executes in that user’s browser, potentially defacing content or stealing session data. Because this is a stored XSS flaw, the impact includes integrity compromise of the site’s content and possible credential theft for authenticated users. The weakness is classified as CWE‑79.

All versions of the Ogulo – 360° Tour WordPress plugin up to and including 1.0.11 are affected. The vendor is Ogulo and the product is the Ogulo – 360° Tour plugin for WordPress.

The CVSS score of 6.4 indicates a medium level of severity. The EPSS score is < 1 %, meaning the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated web‑interface attack: an attacker with Contributor‑level access can create or edit a tour, supply a malicious slug, and the payload is persisted. Subsequent visitors to the affected page will trigger execution of the injected code.