The Autogen Headers Menu plugin can store malicious scripts in the database through the head_class attribute of its autogen_menu shortcode. When a user visits a page containing that shortcode, the injected script runs in the user’s browser, potentially enabling cookie theft, session hijacking, and other client‑side compromise. The flaw is a classic stored XSS (CWE‑79) with no server‑side validation or escaping.

WordPress sites running any version of the Autogen Headers Menu plugin up to and including 1.0.1 are affected. The plugin is released under the vendor amirshk and the vulnerability exists in all code revisions before 1.0.2, if available.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access with at least Contributor privileges, after which an attacker can inject arbitrary JavaScript via the head_class parameter and have it persist for all visitors to the affected page. This makes the attack vector authenticated but not highly privileged, and only possible on pages that already use the compromised shortcode.