Stored Cross‑Site Scripting occurs when the plugin fails to neutralize user input before generating web pages, enabling an attacker to embed malicious script that is later served to site visitors. An attacker can use this to hijack sessions, steal cookies, deface the site, or inject phishing forms, a classic input validation problem (CWE-79).

The vulnerability affects WordPress sites that use the FolioVision FV Simpler SEO plugin version 1.9.7 or earlier, including all earlier releases. Any WordPress installation with these plugin versions is susceptible.

The CVSS score of 6.5 indicates a medium severity, implying potential impact on confidentiality and integrity of user data. The EPSS score is not available, so the current exploitation probability cannot be quantified; nevertheless the vulnerability is not listed in the CISA KEV catalog. Attackers would likely need to supply malicious content through the plugin's input fields, and the injected script will execute for any user who views the affected page, which makes the flaw potentially exploitable in a remote context if the attacker can create content or is an authenticated user.