The Kunze Law WordPress plugin contains a stored cross‑site scripting flaw that allows a user with Administrator‑level access to embed arbitrary JavaScript within the plugin’s shortcode. The plugin fetches HTML from a remote server and writes the response directly into a page without sanitization or escaping, meaning the malicious script will run whenever any visitor loads the affected page. The same shortcode also suffers a path‑traversal weakness that lets the attacker create or overwrite files in any server location that is writable by the web server process, potentially allowing the deployment of additional malicious artifacts such as HTML or PHP files.

WordPress sites running Kunze Law versions through 2.1, including multisite installations or sites where the option unfiltered_html is disabled, are affected. Only users with Administrator (or higher) privileges can achieve the injection, yet the resulting compromised content is visible to all users who view the page.

The CVSS score of 4.4 denotes low severity, and the EPSS score of less than 1% indicates that exploitation is highly unlikely in the wild. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. An attacker must first obtain Administrator access to the site to trigger the flaw; once achieved, stored scripts will execute for every user visiting the content, and the path‑traversal flaw can be used to write arbitrary files, potentially expanding the attack surface. The overall risk is moderate in environments where administrators cannot be fully trusted, but remains low for most deployments due to the elevated‑privilege prerequisite.