The vulnerability is an Improper Neutralization of Input During Web Page Generation leading to stored cross‑site scripting in the Ajay Better Search WordPress plugin. Malicious scripts are injected into the plugin’s data store and executed when users view the affected content, potentially exposing audit or business data, stealing credentials, or defacing the site. The weakness is classified as CWE‑79.

The affected product is the WordPress Better Search plugin from Ajay, all releases from the earliest available version through 4.2.1. Users with the ability to provide input to the plugin—such as content editors or site administrators—are at risk if they operate a site running any of these versions.

With a CVSS score of 5.9 the flaw represents moderate severity, while an EPSS of less than 1% indicates a low likelihood of widespread exploitation at present. The plugin’s web‑based interface is the likely attack vector; an attacker who can submit content that is subsequently displayed to other users can trigger the stored XSS. The flaw is not listed in the CISA KEV catalog, but because it persists in stored data it can continue to affect sites until the plugin is updated or removed.