The vulnerability is an improper neutralization of input during web page generation, known as a Stored Cross‑Site Scripting (XSS) flaw. A malicious actor can inject arbitrary JavaScript that is persisted in the WordPress site’s database by the Remoji plugin. When any site visitor loads a page containing that data, the browser will execute the injected code. This gives an attacker the ability to steal cookies, hijack sessions, deface content or conduct phishing attacks in the victim’s browser, compromising the confidentiality and integrity of the affected site. The weakness is classified as CWE‑79.

The flaw exists in the Remoji plugin for WordPress provided by WPDO. All versions from the earliest release up through 2.2 are susceptible. WordPress sites running any of these plugin versions are impacted. No additional WordPress core versions or other plugins are identified as affected.

The CVSS v3.1 base score of 7.1 indicates high risk. Exploitation is straightforward: an attacker simply needs to submit malicious input that the plugin stores, for example via an emoji or post that later is rendered to all viewers. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, but an attacker could target any site running vulnerable Remoji. As the attack requires only web access, it is highly likely to be attempted.