The WP‑WebAuthn plugin contains a flaw that allows an attacker without authentication to insert arbitrary HTML or JavaScript into the plugin’s log page. The vulnerability arises from insufficient sanitization and output escaping of user‑supplied attributes that are recorded by the plugin whenever the logging feature is enabled. When a logged‑in user opens the log page, the injected code runs in the victim’s browser, potentially dropping malicious scripts or compromising session data. The primary weakness is a classic client‑side injection (CWE‑79).

WP‑WebAuthn, a WordPress plugin developed by axton, is affected in all releases up to and including version 1.3.4. Users running any of those versions with the logging option enabled are exposed; newer releases past 1.3.4 are presumed to contain the fix.

The CVSS score of 6.1 reflects medium severity, indicating that while the vulnerability is not immediately catastrophic, it can lead to significant compromise if exploited in a session‑tainting context. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting limited public exploitation yet. The attack is inferred to be an unauthenticated request to the wwa_auth AJAX endpoint, which makes it easily exploitable by any visitor able to load the log page after the payload is stored.