The vulnerability stems from improper neutralization of input during web page generation, allowing stored cross‑site scripting. An attacker can inject JavaScript that the plugin later serves to visitors. This can lead to cookie theft, session hijacking, defacement, or other client‑side attacks for any user who loads a page containing the compromised data.

WordPress environments using the Rocket Lazy Load plugin from any release up to and including version 2.4.0 are affected. This includes installations of the WP Media Rocket Lazy Load plugin on WordPress sites.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The CVE description implies that the attack vector is web‑based, but the exact method of injecting the malicious payload is not detailed; it is inferred that an attacker could use the plugin’s settings interface or user‑contributed content to store the malicious script. Once injected, the script executes in the browser context of any visitor retrieving the affected page, making it a potent threat to confidentiality, integrity, and trust of site users. Because the attack vector is web‑based and the vulnerability is stored, it can be leveraged by remote actors without needing elevated permissions.