The vulnerability is a classic stored or reflected Cross Site Scripting flaw that allows an attacker to inject arbitrary HTML or JavaScript into pages served by the Site. The flaw exists in versions of the FiboSearch WordPress plugin up to 1.33.0. An attacker who can supply malicious input, or otherwise influence the data stored or rendered by the plugin, could embed scripts that execute in the browser context of any user who views the affected page. This can lead to theft of session cookies, defacement, or execution of further malicious actions on behalf of the victim, thereby compromising confidentiality, integrity, and availability of user sessions.

The affected system is the WordPress FiboSearch plugin developed by Damian Góra. All installations using version 1.33.0 or earlier are vulnerable. No other products or versions were identified as impacted.

The CVSS score of 5.9 indicates medium severity. Because the EPSS score is not available, the probability of exploitation is unclear but the lack of a KEV listing suggests it has not yet been widely exploited in the wild. The likely attack vector is through any input field or data-source that the plugin renders without proper HTML escaping. An attacker with access to deliver such input can trigger the XSS, potentially compromising any user who interacts with the affected content.