The Namasha By Mdesign WordPress plugin has a stored Cross‑Site Scripting flaw caused by insufficient input sanitization and output escaping in the playicon_title parameter. An authenticated attacker with Contributor or higher privileges can inject arbitrary JavaScript that will execute whenever a user views a page containing the injected title, potentially leading to defacement, credential theft or session hijacking. The weakness is a classic input validation problem, classified as CWE‑79.

WordPress sites running the mdezign Namasha By Mdesign plugin, versions 1.2.00 and earlier. The affected plugin is listed as mdesignfa:Namasha By Mdesign in the CNA data and corresponds to the CPE cpe:2.3:a:mdezign:namasha:*:*:*:*:*:wordpress:*:*.

The CVSS score of 6.4 indicates a medium severity, but the EPSS score of less than 1% shows that exploitation of this vulnerability is unlikely at present. The plugin is not included in the CISA KEV catalog, so no known exploitation campaigns have been reported. Attackers would need to log into WordPress with Contributor‑level access or higher, then supply a malicious playicon_title value through the plugin’s management interface. From there, the stored payload will be delivered to all users who view the affected page.