Stored Cross-Site Scripting (XSS) occurs when the plugin fails to properly sanitize and escape a file's description before displaying it on the public file list. When front-end file management is enabled, unauthenticated users can inject malicious scripts that execute in the browser of any visitor viewing the list.