Improper Neutralization of Input During Web Page Generation (Cross‑Site Scripting) in the Hamburger Icon Menu Lite plugin allows an attacker to inject malicious JavaScript that executes in the context of any user who views a page containing the plugin output. The injected script can steal session cookies, deface content, or redirect users to malicious sites, thereby compromising confidentiality, integrity, and availability of the affected website.

The vulnerability affects the WordPress Hamburger Icon Menu Lite plugin by borisolhor. All releases from the initial version up through 1.0 are impacted; no released version newer than 1.0 is known to contain a fix.

With a CVSS score of 7.1 the vulnerability is considered high severity, but an EPSS score of less than 1% suggests a low probability of exploitation at present. It is not listed in the CISA KEV catalog, indicating no known active exploitation. The likely attack vector is a remote attacker crafting a specially formatted URL or embedding malicious content that is reflected back to the user’s browser. Should exploitation occur, attackers could execute arbitrary code in the victim’s context, potentially leading to cookie theft, session hijacking, or defacement of the site.