The vulnerability is a classic client‑side XSS flaw in the WordPress Typing Effect plugin versions up to 1.3.7. It is inferred that the plugin accepts unsanitized text input via its configuration interface, allowing an attacker to inject arbitrary JavaScript. When a page renders the plugin, the embedded script executes in the victim’s browser, enabling exfiltration of cookies, session hijacking, defacement, or delivery of phishing payloads. No privilege escalation beyond what the affected WordPress account possesses is required, but any user who can view the affected page becomes vulnerable.

The affected product is the Typing Effect plugin developed by 93digital for WordPress, with versions less than or equal to 1.3.7. Any WordPress site that has installed or activated the plugin before the 1.3.8 release is at risk. No additional products or versions were identified.

The CVSS score is 6.5, indicating a medium severity vulnerability. The EPSS score is unavailable, so the current estimation of exploitation probability cannot be quantified, but the analog of moderate severity suggests some risk. The vulnerability is not listed in the CISA KEV catalog. It is inferred that attackers would need to supply malicious input through the plugin’s configuration, which likely requires administrative privileges on the WordPress site, but once injected the script runs for all visitors to the page. Because the plugin is client‑side, the impact is limited to the browser, but it can still lead to serious issues such as credential theft or session hijacking. Prevention hinges on patching.