The Post Meta plugin contains a reflected XSS flaw that is triggered by a Cross‑Site Request Forgery (CWE‑352) vulnerability. An attacker can craft a request that, without the victim’s authenticated session, injects malicious JavaScript into the plugin’s output. The unsanitized input is echoed back in the response, enabling attackers to run scripts in the victim’s browser. This can lead to session hijacking, credential theft, or defacement of the site’s content, compromising the confidentiality and integrity of the affected WordPress installation.

WordPress sites running the Mahbubur Rahman Post Meta plugin version 1.0.9 or earlier are affected. No other vendor or product versions are mentioned.

The CVSS score of 7.1 indicates a high severity, yet the EPSS score is below 1%, suggesting that widespread exploitation is unlikely at present. The vulnerability is publicly listed but not yet part of the CISA KEV catalog. An attacker can exploit it by sending a victim to a crafted URL or form that includes malicious payloads rendered by the plugin; the flaw can be triggered via a CSRF request that does not require the victim to be authenticated, which increases its potential impact.