The HurryTimer plugin for WordPress contains an improper neutralization of input during web page generation vulnerability that allows long‑term storage of malicious script code injected by a user. Once stored, the attacker’s code executes in the browsers of all visitors who view the affected content, potentially enabling theft of session cookies, defacement of the site, or subsequent network‑side attacks. The flaw is a classic stored XSS (CWE‑79) and can compromise the confidentiality and integrity of user data.

The vulnerability affects the HurryTimer WordPress plugin developed by Nabil Lemsieh. All versions from the initial release up to and including 2.14.2 are impacted. Users running any of these plugin releases on their WordPress sites are susceptible.

The CVSS score of 5.9 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests that the likelihood of exploitation is very low at present, and the vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve unauthorized input via the plugin’s front‑end or back‑end forms, which the plugin then stores without sufficient sanitization. An attacker who can submit malicious data—either as a user or through other means—could achieve the stored XSS; no additional privileges or remote code execution are required.