The Progress Planner plugin for WordPress contains an improper neutralization of input during web page generation that allows stored cross‑site scripting. The flaw permits an attacker to inject malicious JavaScript into planner data fields, which is then rendered within the site’s pages for all visitors. When an authenticated user inserts attacker‑controlled input, any browser that later views the contaminated planner content will execute the injected script, potentially hijacking user sessions, stealing cookies, defacing the interface, or redirecting traffic.

The vendor responsible for the vulnerability is Emilia Projects, which distributes the Progress Planner WordPress plugin. All versions from the earliest available release up to and including 1.9.0 are vulnerable. The affected product is the WordPress Progress Planner plugin, with the specific version range n/a through 1.9.0.

The CVSS base score of 5.9 indicates a moderate risk level, although the EPSS score is not available. The vulnerability is not yet listed in CISA’s KEV catalog. Exploitation requires the attacker to post malicious content via the plugin’s input forms, which typically needs administrator privileges on the target WordPress site or an account with permission to create or edit planner entries. Once the payload is stored, it will affect every subsequent user who views the altered planner entries, making the attack scalable to all site visitors.