The vulnerability exists in the bundled Lity.js lightbox library of the Woostify plugin, where user-controlled input from the href attribute is concatenated directly into a jQuery–generated HTML string without proper sanitization or escaping. This flaw qualifies as a stored XSS (CWE‑79) and permits an authenticated attacker to inject arbitrary JavaScript that will run for any visitor who views an affected page.

Woostify, a WordPress theme/plugin developed by duongancol, is affected in all releases up to and including version 2.5.0. Users deploying these versions on their WordPress sites are at risk.

The flaw carries a CVSS score of 6.4, indicating a moderate severity. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authenticated access with Contributor-level or higher privileges, the likely attack vector is a compromised contributor account or a privileged user exploiting the custom HTML block. Once injected, the malicious script executes in every user's browser, potentially compromising credentials and data, or hijacking user sessions.