The vulnerability allows an attacker to forge a request to the WordPress site, leading the plugin to store malicious JavaScript code in a header that is later rendered on all pages. Once the code is executed, the attacker can hijack users’ sessions, steal credentials, or perform further attacks. The weakness is a classic CSRF that results in stored XSS, classified as CWE‑352.

Jenst Add to Header plugin, any WordPress installation using versions up to and including 1.0. No specific sub‑versions are disclosed, so the entire < 1.0 range is considered vulnerable.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% suggests that mass exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the forged request from a malicious web page or link that the victim follows, resulting in injection of stored script into the site’s header.