Improper Neutralization of Input During Web Page Generation (Cross‑Site Scripting) in the LSD Custom taxonomy and category meta plugin allows a malicious site to send a CSRF request that injects unescaped user input into taxonomy or category fields. The resulting XSS can execute arbitrary scripts in the context of an authenticated WordPress administrator or user, enabling theft of session cookies, malicious redirects, or defacement. This weakness aligns with CWE‑79.

The affected product is the LSD Custom taxonomy and category meta plugin developed by Bas Matthee. All released versions up through and including 1.3.2 are vulnerable. No specific major or minor version subdivisions are identified beyond the inclusive upper bound.

The CVSS score of 7.1 indicates a high‑severity vulnerability, while the EPSS score of less than one percent suggests a low likelihood of exploitation in the wild. The attacker would most likely need a user who is already logged into the WordPress admin interface to perform the CSRF attack, after which the unescaped input leads to cross‑site scripting. The plugin is not currently listed in the CISA KEV catalog.