The vulnerability is a stored cross‑site scripting flaw in the WordPress WP Discussion Board plugin. Improper neutralization of input during page generation allows malicious code to be retained in the plugin’s database and executed in the browsers of users who view the affected content. This can lead to cookie theft, session hijacking, defacement, and the execution of arbitrary client‑side code with the privileges of the page viewer.

The plugin is affected in all releases up to and including version 2.6.0. Any WordPress site that relies on WP Discussion Board 2.6.0 or older versions remains vulnerable. No specific sub‑versions are excluded beyond the stated latest fixed release 2.6.1.

Based on the description, it is inferred that the attacker can use the plugin’s content submission interface to inject malicious JavaScript. The stored payload is then served to other users, causing arbitrary script execution in their browsers. No higher privileges on the host are required, so the vulnerability is exploitable by any user who can post content. The CVSS score of 6.5 categorizes the flaw as moderate severity. EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog, indicating no current evidence of widespread exploitation. The likely attack vector is the plugin’s content entry interface, where an attacker can submit code that is persisted and rendered to end users.