The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject malicious JavaScript into pages served by WordPress sites using the RSFirewall! plugin. The injected script can execute in the browser context of any visitor, leading to defacement, credential theft, or other client‑side attacks. The weakness is a classic client‑side injection flaw (CWE‑79).

WordPress sites that have the RSJoomla! RSFirewall! plugin installed, specifically any version up to and including 1.1.45. Users of earlier or later versions are not affected. The plugin itself is provided by RSJoomla! and is distributed as a WordPress plugin.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, but exploitation requires the attacker to supply a malicious payload to a site that has the plugin installed, which may be achieved through social engineering or compromised admin accounts. The KEV catalog does not list this vulnerability, so no confirmed exploits are known. However, the stored nature of the payload means that once injected it persists for all site visitors, raising the attack surface. The likely attack vector is a remote web‑based injection delivered by an attacker’s traffic or a compromised administrator.