The vulnerability stems from improper neutralization of user input during web page generation, allowing attackers to inject arbitrary JavaScript into pages rendered by the RealMag777 MDTF wp‑meta‑data‑filter‑and‑taxonomy‑filter plugin. This cross‑site scripting flaw (CWE‑79) can enable attackers to execute scripts in the context of a victim’s browser, potentially leading to session hijacking, defacement, credential theft, or the delivery of additional malware.

Affected systems include WordPress installations that use the MDTF plugin version 1.3.3.8 or older. The vulnerability is present in all releases from the earliest through 1.3.3.8, as identified by the vendor RealMag777.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time, and the issue is not listed in the CISA KEV catalog. However, the attack vector is likely via the plugin’s input handling or URL parameters, meaning any user who can interact with the plugin may be affected. Even with a low exploitation likelihood, the impact of successful XSS warrants prompt remediation.