The plugin accepts the percentage value in a custom post type without sanitizing or escaping the input. This is a CWE-79 Stored Cross‑Site Scripting flaw. An authenticated user with Contributor level access can insert arbitrary JavaScript, which will be rendered and executed in the browser of any visitor who views that label. The flaw does not allow server‑side control or data exfiltration beyond what can be achieved from client‑side code.

WordPress sites using the emaude Canadian Nutrition Facts Label plugin, version 3.0 and earlier.

The CVSS score of 6.4 indicates a moderate risk. An EPSS score of less than 1 % suggests a very low exploitation probability in the near term, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have Contributor‑level or greater access to the site; no additional privileges are needed. Once a contributor injects a malicious payload, every user who visits the compromised label will receive the injected script.