The vendor’s plugin stores user‐supplied text on the site without proper sanitization, which allows an attacker to embed malicious scripts that are later served to other visitors. When a user with sufficient rights inserts malicious code, the script runs in the browsers of all people who view the affected page, potentially revealing session cookies, defacing the site, and executing arbitrary actions on behalf of the user.

The vulnerability affects the WordPress plugin bPlugins Typing Text – Give your texts many typing effects, versions up to and including 2.2.0. All installations that have not been updated beyond this version are at risk.

This vulnerability carries a CVSS score of 6.5, indicating intermediate severity. No EPSS score is available, and it is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. Attacks would likely occur from an authenticated user who can edit plugin content or from a site administrator, enabling the insertion of the malicious payload into stored content that is later rendered to visitors.