The Breakdance WordPress plugin is vulnerable to stored cross‑site scripting via the 'fields' parameter in all releases up to and including version 2.7.1. Unauthenticated attackers can insert arbitrary JavaScript that is saved to the site and executed whenever a user views a page containing the malicious data, which creates a risk of client‑side exploitation.

Any WordPress site using the Breakdance plugin version 2.7.1 or earlier is affected. Updating to 2.7.2 or later removes the vulnerable code.

The CVSS score of 7.2 indicates a high severity level. The EPSS score of <1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred from the description: the vulnerability can be triggered by sending a crafted request to the plugin’s webhook or form endpoint without requiring authentication. Once the script is stored, it will run in the browsers of any user who views the affected page. Based on the description, it is inferred that client‑side exploitation will occur when impacted users access pages containing the injected scripts.