The vulnerability is an Improper Neutralization of Input During Web Page Generation that allows stored cross‑site scripting in the Zotpress WordPress plugin. An attacker can inject malicious JavaScript that will be executed in the browsers of any user that views affected content. The impact includes theft of user credentials, session hijacking, defacement, and the ability to perform further attacks against site visitors. This weakness falls under CWE‑79.

The affected products are WordPress sites running the Zotpress plugin by Katie Seaborn, version 7.4.4 or older. All releases prior to 7.4.5 are vulnerable, including the default installation and any previously deployed patch levels.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The exploit requires the attacker to supply payloads to a data entry point that stores content unfiltered; it is likely valueable for attackers with any level of authenticated access to add or edit Zotpress entries. Once payloads are stored, every visitor who loads the affected content will execute the malicious script, enabling widespread impact.