The vulnerability exists in the mpac_title_tag parameter of the Magical Posts Accordion widget in versions up to and including 1.2.54. Insufficient sanitization of user‑supplied HTML tag names lets an authenticated user with Author or higher privileges embed malicious scripts. When a victim opens a page that contains the injected widget, the script executes within the victim’s browser, enabling credential theft, session hijacking, or other client‑side attacks.

The affected product is Magical Posts Display – Elementor Advanced Posts widgets from the vendor denoted as nalam-1. All releases from the first version through 1.2.54 are susceptible. Users deploying any of these releases on WordPress sites should verify their installed version.

The CVSS score of 6.4 indicates a moderate severity, with an EPSS score of less than 1% suggesting a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires authentication and can be launched from the WordPress admin console, where an attacker with Author or higher privileges can configure the widget. Successful exploitation results in arbitrary code execution in the context of any user who visits the page, potentially compromising confidentiality, integrity, and availability of the site’s user data.