The Penci Review plugin stores user‑supplied data without proper sanitization, enabling stored cross‑site scripting attacks. This flaw allows an attacker to insert malicious scripts that execute in the browsers of visitors, potentially leading to session hijacking, defacement or malware delivery. The weakness is an input validation flaw (CWE‑79).

The vulnerability affects the WordPress PenciReview plugin from its earliest release through version 3.5 inclusive, issued by PenciDesign.

The CVSS score of 6.5 indicates moderate risk, and an EPSS score of less than 1% suggests the likelihood of exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires the ability to submit content that will be rendered by the plugin, although the CVE does not specify the exact attack vector. Detection is challenging because the payload is stored and only rendered later.