The vulnerability is a classic cross‑site scripting flaw that can be triggered without authentication by submitting a crafted request to the WordPress Persistent Login plugin. An attacker can embed malicious code in the plugin’s input fields, which the plugin later outputs without sanitization. This flaw allows attackers to steal cookies, hijack sessions, deface the site or execute arbitrary script on users’ browsers.

The affected product is the WordPress Persistent Login plugin by lukeseager. Versions 3.1.3 and earlier are vulnerable; no other WordPress components are listed as affected by the CNA.

The CVSS score of 7.1 indicates high severity. Exploitability is high because the attack requires no credentials and only a crafted request; the EPSS score is not available, and the vulnerability is not listed in CISA KEV. An attacker with a simple URL can trigger the flaw if the site uses a vulnerable plugin version, exposing the website to confidentiality, integrity and availability risks for visitors.