The Dropdown Content plugin contains an improper input neutralization flaw that allows an attacker to store malicious script code in the plugin’s content fields. When a compromised user views the affected page, the stored script is rendered in the browser, executing in the context of the site and enabling hijacking of cookies, defacement, or other malicious activities. The vulnerability is a classic stored XSS, leveraging the plugin’s lack of output sanitization during web page generation.

Affected are installations of the metaloha Dropdown Content plugin for WordPress with version 1.0.2 or earlier. The issue applies to all users who have deployed this plugin in that version range and use its content‐output functionality.

The CVSS base score is 7.1, indicating a high impact if exploited. The EPSS score of less than 1% suggests that exploitation attempts are low, and the vulnerability is not listed in the CISA KEV catalog. However, the likely attack vector is a stored XSS that requires an attacker to have an authenticated or unauthenticated ability to submit content through the plugin’s input fields, after which the malicious code persists until the plugin is updated or the content is removed.