WP Import Export Lite before version 3.9.33 does not escape custom field names that are retrieved from its database before inserting them into the DOM or higher privileges can craft these custom field names to contain malicious JavaScript; when an administrator views that screen the script runs with the administrator’s browser context. This stored DOM‑based XSS can enable session hijacking, credential theft, or defacement and represents the weakness described by CWE‑79.

The vulnerability is present in the WordPress plugin WP Import Export Lite, affecting all releases prior to 3.9.33. The vendor is not publicly listed in the data, but the plugin is widely distributed through the WordPress plugin repository.

The EPSS score is below 1 %, indicating a low likelihood of exploitation, and the vulnerability is not recorded in the CISA KEV catalog. The attack requires only that a contributor add or modify custom field names the affected screen, which limits the impact to those privileged users. Nevertheless the stored payload executes with high‑privileged context, making the risk significant for administrators.