The SNORDIAN H5PxAPIkatchu WordPress plugin contains an insufficiently sanitized and escaped input in the AJAX endpoint named insert_data, which delivers the injected content in stored form. An attacker who is not authenticated can place arbitrary JavaScript in a page; when any user loads that page the script runs in the victim’s browser, potentially enabling credential theft, session hijacking, or defacement. This weakness is classified as CWE‑79.

WordPress sites that use the SNORDIAN H5PxAPIkatchu plugin, versions up to and including 0.4.17.

The vulnerability carries a CVSS score of 7.2. The EPSS score is less than 1 % and the weakness is not included in the CISA KEV catalog, indicating low current exploitation likelihood. However, the flaw is exploitable through a public‑facing AJAX endpoint, meaning an unauthenticated attacker can reach the code path and inject payloads without further compromise.