The WordPress HTML custom‑html‑bodyhead plugin contains an improper neutralization of input during page generation, allowing malicious script code to be stored in the database and subsequently delivered to browsers without escaping. This stored XSS flaw means that any script injected through the plugin interface can execute in the context of visitors who view the affected page, potentially exposing session data or defacing content.

Vendor stanton119 publishes the WordPress HTML custom‑html‑bodyhead plugin. Versions of the plugin up to and including 0.51 are affected. WordPress site operators using these versions of the plugin are susceptible unless the plugin is removed or upgraded beyond 0.51.

The CVSS score of 6.5 indicates a moderate impact, reflecting the need for an attacker to write content via the plugin interface and the resulting effect on designated users. The EPSS score of under 1 % shows that the likelihood of current exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires access to the plugin’s administrative interface; once malicious content is stored, the XSS payload will be triggered whenever the page containing the data is rendered for any browser.