Metaphor Widgets, a WordPress plugin developed by Metaphor Creations, suffers from an improper neutralization of user input during page rendering. The vulnerability allows an attacker to embed malicious JavaScript that is stored in the plugin’s widget content and later served to site visitors. As a result, any user who loads the affected page can execute arbitrary scripts in the victim’s browser, enabling session hijacking, defacement, or phishing. This flaw relates to CWE‑79, causing a moderate risk of confidentiality and integrity compromise.

All installations of the Metaphor Widgets plugin from initial releases through version 2.4 are affected. The plugin is distributed by Metaphor Creations and is commonly used in WordPress themes to display customizable widgets.

The CVSS v3.1 score is 6.5, indicating moderate severity. The EPSS score below 1 % suggests a low current exploit probability, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw via the plugin’s administrative interface by inserting malicious script into widget content, or by posting the script through any user‑generated content path that the plugin does not sanitize. Successful exploitation requires that the attacker have editing rights to a widget or be able to inject content that persists in the database.