An improper neutralization of input in Daniel Iser’s Easy Modal plugin allows an attacker to store malicious code in site content that is later rendered to visitors, resulting in a stored Cross‑Site Scripting (XSS) condition. Overwritten or injected scripts may run in the context of the victim’s browser, potentially capturing credentials, session cookies, or further compromising the site. The weakness represents a client‑side exploitation that affects integrity, confidentiality and availability for any user who views the compromised page.

WordPress websites that use Easy Modal plugin version 2.1.0 or older. Any instance where the plugin is installed and the default settings allow content entry via the WordPress editor or plugin settings would be vulnerable. The issue is limited to the Easy Modal plugin and does not affect other WordPress components unless the same attack vector is present elsewhere.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Although the attack surface is restricted to users who have the capability to input plugin data, affected administrators or trusted commenters could exploit the flaw. Successful exploitation would allow arbitrary script execution in the context of site visitors, potentially leading to data theft or defacement.