The vulnerability allows an authenticated attacker with Editor‑level or higher privileges to store malicious JavaScript in the 'Icon CSS Class' field of a category. Because the plugin does not properly escape user input when rendering the icons, the injected script runs in the context of any visitor who views a page containing that category. This is a classic stored XSS flaw (CWE‑79), enabling attackers to hijack user sessions, deface content, or redirect users to phishing sites.

The affected plugin is WPB Floating Menu or Categories – Sticky Floating Side Menu & Categories with Icons for WordPress. All installed copies of the plugin version 1.0.8 and earlier are vulnerable. No other WordPress components are mentioned as affected.

The CVSS score is 4.9, representing moderate severity. The EPSS score is not provided and the issue is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited in the wild. Exploitation requires an authenticated user with the Editor role or higher. An attacker can create or modify a category and supply a crafted value for the icon CSS class; when any site visitor loads a page that displays that category, the embedded script executes, compromising that visitor’s session or delivering further payloads.