The vulnerability enables an attacker to embed malicious scripts into the RepairBuddy plugin's stored content. When an authenticated or unauthenticated user visits any page that displays this content, the script runs in the context of the victim’s browser. This allows the attacker to perform operations such as capturing credentials, defacing the site, or redirecting users to malicious sites. The weakness arises from insufficient input sanitization, identified as Cross‑Site Scripting (CWE‑79).

The flaw affects the WordPress RepairBuddy plugin provided by Webful Creations. All installed versions from the earliest release through 4.1225 are vulnerable. Site administrators should verify the plugin version and upgrade to a fixed release.

The CVSS score is 6.5, indicating a moderate severity. No EPSS data is available, but the lack of a KEV listing suggests no active exploitation campaigns are reported. The likely attack vector is through the plugin’s content entry forms, allowing an attacker to inject arbitrary script, either as a logged‑in user or via a form that accepts external input.