The vulnerability results from improper input neutralization during web page generation in the immonex Kickstart plugin. This allows an attacker to inject and store malicious scripts that are subsequently executed within the context of the site, providing the ability to hijack user sessions, deface pages, or deliver malware to visitors. The weakness is classified as CWE-79 (Cross‑Site Scripting).

Vendors and products identified by the CNA include immonex:immonex Kickstart. All versions from the earliest released build through version 1.13.0 are affected; no higher versions are listed as impacted. Exact version ranges are not provided beyond the upper bound 1.13.0.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests low current exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through any input fields supplied by the plugin that are stored in the database without proper sanitization, requiring access to such forms (e.g., via admin or other authenticated users). The attack would place attacker‑controlled code in stored content, which is rendered to site visitors.