The vulnerability arises from insufficient sanitization of the widget content field in the Gutenberg editor, allowing an authenticated user with Contributor level or higher to persist malicious scripts. When a page containing the injected content is viewed, the script executes in the visitor’s browser, exposing the site to data theft, session hijacking or defacement. This stored XSS flaw enables full client‑side compromise of any visitor accessing the affected page, leading to loss of confidentiality, integrity, and availability of the web application for all users.

WordPress installations running the Dynamic Widget Content plugin version 1.3.6 or earlier are impacted. The plugin is authored by BrechtVDS and is typically installed as a WordPress plugin.

The flaw carries a medium CVSS score of 6.4, yet its exploit probability is very low, with an EPSS of less than 1% and no listing in the CISA KEV catalog. The attack requires authentication with at least Contributor privileges, meaning that users with this role can exploit it directly. Although the exploit window is narrow, the impact on all users who view the injected pages is severe, and the lack of public exploits does not preclude future development of zero‑day methods.