The vulnerability is an Improper Neutralization of Input During Web Page Generation flaw that allows attackers to inject malicious script content that is stored in the WordPress File Upload plugin. When an affected user later views a page containing the injected content, the script runs in the victim’s browser context, potentially enabling session hijacking, defacement, or data exfiltration.

The flaw exists in the Nickboss WordPress File Upload plugin version 5.2.1 and earlier. The plugin provides a file upload interface that stores user supplied data directly in the database without proper sanitization. The affected product is the WordPress File Upload plugin (nickboss:wp-file-upload).

The CVSS score of 7.1 indicates a moderate severity overall. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation. The likely attack vector is an attacker uploading or submitting data through the file upload interface that includes unsanitized JavaScript or HTML. Once stored, the payload is executed in the context of any user who views the content, which can lead to theft of session cookies or execution of arbitrary code within the page.