Improper neutralization of input during web page generation (CWE‑79) creates a stored cross‑site scripting (XSS) flaw in the Omnipress WordPress plugin. Content added via the plugin’s interface is rendered without proper sanitization, allowing an attacker to embed malicious scripts that will run in the browsers of any user who views the affected content. This can enable client‑side code execution but does not expose server‑side resources directly.

Omnipress, a WordPress Gutenberg block editor developed by omnipressteam, is vulnerable in every release up through version 1.6.7. Site administrators using any of these releases are at risk if the plugin is active.

With a CVSS score of 6.5, the flaw is rated medium. The EPSS score is below 1%, indicating a historically low probability of exploitation, and it is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the vulnerability can be triggered via the plugin’s web interface and that an attacker would need the ability to add or modify content through the plugin’s authoring interface. The likely attack vector is web‑based. Successful exploitation would result in arbitrary client‑side script execution rather than direct server compromise.