The Add custom content after post plugin permits an attacker to inject arbitrary script code into a WordPress page through unsanitized input. Based on the description, it is inferred that the attacker can trigger the vulnerability via a crafted URL or HTTP request containing malicious script, which the plugin then reflects back into the page. This reflected cross‑site scripting flaw, identified as CWE‑79, lets malicious scripts run in the browser of any user who views the affected page. The consequences include exposure of sensitive data, credential theft, and the ability to perform further attacks from the victim’s session.

WordPress sites that have installed Fabio Zuanon Add custom content after post plugin version 1.0 or earlier are vulnerable. All installations using any application of this plugin publish may be exposed because the issue spans from its initial release up to and including version 1.0.

The CVSS score of 7.1 indicates a moderate to high severity vulnerability. The EPSS score of less than 1% suggests that exploitation is unlikely in the short term, and the flaw is not currently listed in the CISA KEV catalog. Attackers can exploit the flaw via a web request that contains malicious script in a reflected parameter, typically through a crafted URL viewed by the target user.