A malicious actor can inject arbitrary JavaScript into a page displayed to site visitors. The injected code executes in the context of the visitor’s browser, giving the attacker the ability to steal session cookies, hijack accounts, or modify page content. The weakness is a classic cross‑site scripting flaw as categorized in CWE‑79.

Site owners who have installed any version of the WordPress pixfort Core plugin older than 4.3.3 are affected. Based on the description, it is inferred that the vulnerability exists regardless of the WordPress core version or other plugins that may be present on the site.

With a CVSS score of 5.4 the vulnerability is considered medium severity. No EPSS score is available, so the empirical likelihood of exploitation cannot be quantified. The flaw is not listed in CISA’s KEV catalog, but it can be exploited by sending malicious input through the plugin’s publicly exposed fields or shortcodes, with the effect running in the visitor’s browser. Attackers need only craft a payload and link it to the vulnerable site, making discovery and exploitation straightforward.