The plugin stores user‑supplied content without proper sanitization, enabling stored XSS attacks. This allows an attacker to inject malicious JavaScript into stored data that is later rendered, leading to client‑side code execution, session hijacking or site defacement. The flaw is a typical cross‑site scripting weakness (CWE‑79). This vulnerability can affect any user who visits a page that displays the injected content, potentially compromising confidentiality, integrity and availability of the affected site.

The issue applies to the WordPress UiCore Elements plugin by the vendor uicore, affecting all releases up to and including version 1.3.14. No pre‑1.3.14 versions were patched already. Any WordPress installation that uses this plugin version is vulnerable.

The CVSS score of 6.5 indicates moderate severity. EPSS is less than 1%, so exploitation is considered unlikely at present, and the weakness has not been catalogued by CISA's KEV list. Exploitation requires the attacker to insert malicious payloads into the plugin’s stored content – typically through the plugin’s content editor or any interface that accepts HTML input. Since the payload is stored, once an authorized or anonymous user views the affected page, the injected script runs in the victim’s browser. The impact is limited to the client side, so no direct server compromise is achieved unless the attacker can leverage other vulnerabilities.