The recorded vulnerability is a stored cross‑site scripting flaw that fails to sanitize input reflected in the Hummingbird plugin’s webpages. The flaw allows an attacker to inject malicious scripts that are rendered when any user loads the affected page. An attacker could compromise the confidentiality and integrity of a site’s data, deface content, or perform session hijacking on the end‑user’s browser. The weakness is classified as CWE‑79.

WPMU DEV Hummingbird plugin version 3.21.2 and earlier are affected. An update to version 4.0.0 or later removes the flaw. No other product versions are explicitly listed.

The CVSS base score of 6.5 indicates a medium‑to‑high risk. The EPSS score is not available, obscuring current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The attack vector is inferred to be remote, as the flaw exists in web‑accessible functionality; an adversary only needs to supply malicious input via any administrative interface or exposed endpoint that stores data in the database.