The vulnerability is an Improper Neutralization of Script-Related HTML Tags in a web page (Basic XSS) that allows an attacker to inject arbitrary script content when the Textmetrics plugin processes user-generated content. This flaw could lead to client-side code execution in the browsers of site visitors, resulting in session hijacking, defacement, or malicious redirects. The weakness is rooted in invalid input sanitization, identified as CWE‑80.

WordPress Textmetrics WebtextTool plugin by Israpil, affected through version 3.6.5 inclusive. All installations of this plugin at or below that version are vulnerable.

The CVSS base score is 4.3, indicating moderate severity. The EPSS score is below 1 %, implying a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, exploiting content insertion or shortcode handling by authenticated or unauthenticated users who can submit data to the plugin. While the vulnerability does not expose remote code execution on the server, it permits malicious scripts to run in the context of the victim’s browser, which is a moderate risk for sites with public exposure.