The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 fails to validate the contents of files uploaded through its file storage feature and serves them back with an attacker‑controlled content type. This allows an unauthenticated attacker to store a file containing malicious JavaScript that executes in the browser of any user who opens it. The flaw is a classic example of a stored cross‑site scripting vulnerability (CWE‑79) that can lead to unauthorized execution of arbitrary code in the context of the victim’s browser, resulting in potential theft of session cookies, defacement, or further credential compromise.

Any installation of the Verge3D Publishing and E-Commerce WordPress plugin with a version earlier than 4.13.1 is affected. The vulnerability exists in the plugin’s file storage API and is independent of the host WordPress version or other plugins.

The flaw is exploitable by any user with access to the web interface that accepts file uploads, and does not require authentication. Because the malicious payload is stored and executed in victims’ browsers, the risk of exploitation is high. The CVSS score of 8.8 places the vulnerability in the high severity range, while the EPSS score of <1% indicates that exploitation is currently considered unlikely. The vulnerability is not listed in the CISA KEV catalog. The combination of a high CVSS score with a low EPSS score suggests that, although the flaw is severe, the probability of real‑world exploitation remains low.