Technical impact
The flaw originates from improper neutralization of input during web page generation, allowing an attacker to store malicious scripts within the WordPress Orphans plugin. Once stored, these scripts are served to any visitor of the affected WordPress site, potentially leading to session hijacking, data theft, or site defacement. This vulnerability corresponds to CWE‑79 (Improper Neutralization of Input).
Affected Systems
WordPress Orphans plugin by iWorks (sierotki) versions up to and including 3.4.6 are vulnerable; all installations using those versions are at risk. The plugin is widely deployed on WordPress sites, so the exposed attack surface is considerable.
Risk and Exploitability
With a CVSS score of 7.1 the risk is moderate to high; no EPSS data is presently available, making precise exploitation probability uncertain. The vulnerability is not yet listed in the CISA KEV catalog, and no public exploits are documented. Attackers would require functional input fields within the plugin to inject malicious payloads, typically via an account with sufficient privileges to submit or modify content. Once the stored payload is served, any site visitor’s browser executes the script under the site’s origin.
