The vulnerability is an improper neutralization of input during web page generation that allows stored cross‑site scripting (XSS) in the Head Meta Data plugin for WordPress. An attacker can store malicious script content that the plugin subsequently outputs unfiltered into the head section of the site’s pages, resulting in arbitrary client‑side script execution for any visitor. The weakness is classified as CWE‑79.

The product affected is Jeff Starr Head Meta Data, a WordPress plugin. All releases from the product’s initial launch up to and including version 20250327 are affected, as defined by the CNA. No other vendors or product variants are listed in the current CVE entry.

The CVSS score is 5.9, indicating a moderate risk level. The EPSS score is below 1 %, showing a very low likelihood of exploitation at present. The vulnerability is not included in the CISA KEV catalog. A successful exploit would require an attacker to inject malicious content that the plugin stores and that is later rendered in pages; the script would then execute in the browsers of any visitor to those pages.