The vulnerability arises because the plugin fails to sanitize user‑supplied data that is later rendered on web pages, allowing an attacker to embed malicious JavaScript that executes in the browsers of anyone who views the affected page. This results in stored cross‑site scripting that can be leveraged to hijack user sessions, steal cookies, or deface the site. The weakness corresponds to CWE‑79.

Affected systems include the WpEstate Wpresidence Core plugin, any version prior to and including 5.4.0. WordPress sites that have installed this plugin within that version range are vulnerable. The impact is limited to the rendering of content within the plugin but can affect all visitors to the affected pages.

The base CVSS score of 6.5 indicates moderate severity while the EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web‑based via the plugin’s data entry interfaces; based on the description, an attacker would need to submit malicious payloads through these interfaces, and the successful attack would require a victim to load the affected page. No additional prerequisites beyond access to the data entry points appear to be required.