The vulnerability is a stored Cross‑Site Scripting flaw caused by improper neutralization of user input during web page generation in the BoldGrid Sprout Clients WordPress plugin. Because the plugin fails to escape or sanitize content that is stored and later displayed, an attacker can inject malicious scripts into fields that are rendered to other visitors. Once executed in a victim’s browser, the payload can hijack the user’s session, steal credentials, deface the site, or redirect users to malicious sites. The weakness is classified as CWE‑79, indicating a flaw in input validation and output encoding.

The defect impacts the BoldGrid Sprout Clients plugin for WordPress. All releases through and including version 3.2.2 are vulnerable; no other products or later versions are mentioned as affected.

The CVSS score of 6.5 signals moderate severity, while an EPSS score of less than 1% indicates a low observed exploitation probability. The CVE is not listed in the CISA KEV catalog, reducing its known widespread exploitation risk. The likely attack vector requires a user (or attacker with the ability to submit data) to inject malicious payloads into the plugin’s storage fields; no special privileges or external network access are required. Successful exploitation remains restricted to client‑side impacts such as session theft or defacement, though it can affect the confidentiality and integrity of user sessions.