The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross‑Site Scripting because the 'podata' parameter is not properly sanitized or escaped. This flaw allows an authenticated user with subscriber-level rights or higher to embed malicious JavaScript into translation files that WordPress later serves. When a site visitor accesses any page that loads the affected translation file, the injected script runs in their browser, potentially exfiltrating data, defacing content, or hijacking sessions. The weakness is classified as CWE‑79 and carries a CVSS score of 6.4.

WordPress sites that use the dougwollison PO/MO Editor plugin version 1.4.2 or earlier are affected. The vulnerability resides in the plugin’s handling of the 'podata' parameter via the load_textdomain_mofile filter, which injects the malicious payload into the translation files served by WordPress.

The CVSS score of 6.4 indicates a moderate impact, and the EPSS score of less than 1% implies a currently low likelihood of exploitation. The flaw requires an authenticated WordPress user with subscriber-level privileges or higher, and it relies on the plugin’s translation file loading mechanism, which WordPress does not automatically mitigate. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation at the time.