The vulnerability lies in the plugin’s asmp‑switcher shortcode, where user‑supplied attributes are not properly sanitized or escaped, a weakness classified as CWE‑79. An authenticated contributor or higher user can inject arbitrary JavaScript that is stored in the post content and executed for any visitor of the affected page. This stored XSS enables attackers to hijack user sessions, deface content, or deliver malware, affecting the confidentiality, integrity, and availability of the site’s users.

WordPress sites running the plugin "A Simple Multilanguage Plugin" by piupiiu, in any version up to and including 1.0, are affected. No specific sub‑version data is listed, so all releases through version 1.0 are vulnerable.

The vulnerability has a CVSS score of 6.4, indicating a moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalogue. However, because the zero‑day requires authenticated contributor‑level access, it can be leveraged by internal users or anyone who obtains such credentials, making monitoring and prevention essential.