The stored cross‑site scripting vulnerability in the Crowd Favorite DXP ToolKit WordPress plugin allows an attacker to inject malicious client‑side scripts that are served to visitors. The flaw arises from the plugin’s failure to neutralize user‑supplied input during page generation, meaning an attacker who can submit data (for example, through a post or custom field) can embed JavaScript that executes when any visitor loads the affected page, enabling session hijacking, defacement, or payload delivery. This weakness is CWE‑79.

The affected product is the Crowd Favorite DXP ToolKit WordPress plugin, for all versions up to and including 2.0.1.

The CVSS score of 7.1 indicates a high severity. The EPSS score is unavailable and the vulnerability is not listed in CISA KEV. The likely attack vector is a stored XSS that requires the attacker to submit malicious input to the plugin’s input fields; any site visitor then receives the injected script. The risk of exploitation is moderate to high, given the widespread use of WordPress and the ease of submitting content through the plugin. Compromise may lead to credential theft, defacement, or delivery of additional malware.