The Press3D plugin does not validate or sanitize the URL scheme entered for a 3D model link. This flaw lets an authenticated user with Author or higher privileges persist a value that begins with the javascript: scheme, causing arbitrary script execution when a site visitor clicks the link. The result is stored Cross‑Site Scripting that can run on every viewer’s browser.

WordPress sites that have the Press3D plugin installed and are running any version up to and including 1.0.2 are affected. Any user with Author level or greater access on those sites can create or edit a 3D model block and insert the malicious URL.

The vulnerability carries a medium severity score of 6.4 and an exploitation probability estimate lower than 1%. The plugin is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires authenticated access as Author or higher and involves the malicious user inserting a javascript: link into a 3D model block. Based on the description, it is inferred that the inserted script could read cookies, hijack sessions, or deface content, but those specific outcomes are not explicitly confirmed in the advisory.