The Header Footer Script Adder plugin allows contributors or higher‑level users to add scripts through its post editor; the plugin does not sanitize this input or escape the output, so malicious JavaScript can be stored in the post content and will run in the browser of any user who views the post. This stored Cross‑Site Scripting flaw can enable attackers to run arbitrary client‑side code on the site’s front‑end, potentially impacting user sessions or delivering malicious payloads.

WordPress sites that install the Header Footer Script Adder plugin version 2.0.5 or earlier are affected. Any installation where a user with Contributor or higher rights can edit posts is vulnerable because the plugin does not restrict script input.

The CVSS score of 6.4 indicates a medium severity issue. The EPSS score of less than 1% points to a low exploitation probability at present, and the vulnerability is not listed in CISA’s KEV catalog. An attacker must be authenticated with Contributor or higher privileges to insert the malicious code; after the script is stored, any visitor to the affected page will execute the code in their browser. The exploit does not require additional privileges beyond the specified role and could be used to redirect users or inject harmful content.