The Simple Meta Tags plugin for WordPress fails to properly neutralize user‑supplied input when generating page content, allowing a DOM‑based XSS flaw. An attacker can inject malicious scripts that run in the victim’s browser, potentially leading to cookie theft, session hijacking, defacement or other client‑side attacks. The CVSS score of 6.5 indicates a moderate severity flaw that could affect the confidentiality, integrity, or availability of user sessions.

Vulnerable versions are DaganLev Simple Meta Tags plugin for WordPress up to and including 1.5. No further sub‑version details are supplied, so any installation of this plugin with a version ≤ 1.5 is at risk.

The EPSS score is below 1 %, indicating a low probability of exploitation as of the current data. The flaw is client‑side and can be triggered by tricking a user into visiting a crafted URL or interacting with a manipulated input field. Because it is listed as not in CISA’s KEV catalog, no publicly known exploits have been reported, but the moderate CVSS and potential for XSS warrant prompt attention.