An administrator or higher level user can inject arbitrary JavaScript into pages that display the plugin’s content. The injected scripts run automatically for any visitor who views a page that includes the malicious code, potentially leading to credential theft, session hijacking, or defacement. Because the payload is stored within plugin settings, the vulnerability persists until the plugin data is cleaned or the plugin is updated. The weakness is classified as CWE‑79, a classic stored XSS flaw.

The plugin "Interactive Human Anatomy with Clickable Body Parts" from vendor clickanatomy is affected in all released versions up to and including 2.6. The issue surfaces only on WordPress multi‑site setups where the unfiltered_html capability is disabled for standard users; it does not impact single‑site installations or scenarios where unfiltered_html remains enabled for all users.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% reflects a very low likelihood of exploitation at this time. The vulnerability is not catalogued in CISA’s KEV list. Exploitation requires authenticated access to the plugin’s administrative settings on a multi‑site WordPress network with unfiltered_html disabled, a scenario that limits the attack surface but still exposes high‑privileged users to risk. The likely attack vector involves an attacker logging in with an admin or super‑admin role, navigating to the plugin settings, and submitting malicious JavaScript that is then executed for any site visitor viewing the affected pages.