The vulnerability allows an attacker to inject malicious JavaScript into the comment field of the Smart Cookie Kit plugin. The injected payload survives the plugin’s HTML parsing logic and is only rendered when an administrator approves the comment. Once approved, the script executes in the browsers of any visitor to the affected post, potentially exposing session data, performing phishing, or delivering additional client‑side attacks.

WordPress sites that have installed Smart Cookie Kit by shark986 up to and including version 2.3.2 are affected. Any site that permits unauthenticated comment submissions which are later approved by an administrator exposes a stored XSS vector.

The CVSS score of 5.4 indicates moderate severity, and no EPSS data is available, suggesting limited real‑world exploitation evidence. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to submit a crafted comment, wait for administrative approval, and then have a target user view the affected post. The risk rises if social engineering is used to influence an admin to accept malicious comments.