The ABG Rich Pins WordPress plugin suffers from an improper neutralization of input during web page generation, which allows a stored cross‑site scripting flaw. When inappropriate content is stored by the plugin, it is later rendered in pages viewed by visitors, giving an attacker the ability to execute malicious scripts in the browsers of site users. This can lead to phishing, credential theft, or site defacement and compromises the confidentiality, integrity, and availability of content for site visitors. The vulnerability is a classic input validation issue catalogued as CWE‑79.

WordPress installations that have installed the ABG Rich Pins plugin from the antoniobg vendor and are running version 1.1 or earlier are affected. The issue exists in all releases from the first public version up to and including 1.1; no sub‑version list is provided.

The CVSS score of 5.4 indicates medium severity. The EPSS score is less than 1 %, indicating a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are documented. The likely attack vector requires a user with permission to add or edit content through the plugin’s interface, after which a malicious payload is stored and subsequently served to visitors.