The flaw stems from improper neutralization of user input during web page generation, allowing an attacker to inject JavaScript that is stored in the database and rendered to site visitors. This stored cross‑site scripting can execute in any visitor's browser, enabling cookie theft, defacement, or redirect to malicious sites. It is a classic CWE‑79 flaw.

The vulnerability affects the WordPress 'Speaker' plugin from merkulove. All releases from the first version up to and including 4.1.13 are impacted. Sites running any of these plugin versions should consider the issue relevant.

The CVSS score of 6.5 signals moderate severity. The EPSS score is below 1%, indicating a low exploitation likelihood, and the bug is not listed in the CISA KEV catalog. The likely attack vector is that an attacker could inject malicious script via input accepted by the plugin, but whether that requires authenticated access or not is not explicitly stated—this is inferred from typical XSS flow. Once a malicious payload is stored, it will be served to any site visitor. Prevention hinges on applying an available vendor patch or disabling the plugin until a fix is released.