The harmful content is stored, for example in a comment, a plugin setting or a post field, and is delivered to every visitor who loads that page. It does not require the victim to click a crafted link.
On WordPress the highest risk is a script that runs in an administrator's browser. It acts with that person's session and can change settings, create accounts or install code, which can turn a content flaw into a full site takeover.
Fixes come from vendor patches that sanitize input and escape output. Update promptly, limit who can submit rich content, restrict administrator browsing while logged in, and check the database for unexpected script content after a known exposure.