The vulnerability in PenciDesign’s Penci Filter Everything WordPress plugin allows stored cross‑site scripting. Improperly sanitizing user input during page generation means an attacker who can inject data into the plugin’s storage area can have arbitrary script executed in the browser context of any site visitor. This can lead to session hijacking, defacement, or delivery of malicious payloads. The weakness is identified as CWE‑79.

WordPress sites running the Penci Filter Everything plugin version 1.7 or earlier are impacted. The vulnerability applies to any installation that has not been upgraded beyond the 1.7 release, regardless of additional plugins or active themes.

The CVSS v3.1 score of 6.5 indicates a moderate severity, but the EPSS score of less than 1% suggests exploitation is currently rare. The vulnerability is not listed in CISA’s KEV catalog. Likely the attack vector involves a privileged administrator or editor inserting malicious content into the plugin’s input fields; the stored payload then executes automatically for every visitor to the affected pages. Attack prerequisites include access to administrative interfaces and the ability to store or edit content managed by Penci Filter Everything.