The Easy Jump Links Menus plugin is vulnerable to stored cross‑site scripting because the h_tags parameter is not properly sanitized or escaped. This flaw lets any authenticated user with Contributor or higher permissions embed malicious scripts into pages. When a visitor opens an affected page, the injected scripts run in that visitor’s browser, potentially stealing session data, defacing content, or redirecting traffic. The weakness is an example of CWE‑79 – Improper Neutralization of Input During Web Page Generation.

WordPress sites that use the webradykal Easy Jump Links Menus plugin and are running any release up to and including version 1.0.0 are impacted. The vulnerability exists in all versions prior to 1.0.0.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% shows a low likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog. Exploitation requires a legitimate contributor or higher login and involves inserting malicious content through the plugin’s shortcode editor or page editor. If successfully exploited, the attacker can compromise site visitors’ browsers and potentially compromise the site’s integrity.