The vulnerability in the Mmm Unity Loader plugin permits the storage of malicious JavaScript through the attributes parameter. When a page that contains the injected content is viewed, the browser executes the script, which could be used to steal session cookies, deface content, or perform other client‑side attacks. The impact is limited to the client’s browser execution context, but it can affect all visitors to the offending page.

All versions of the Mmm Unity Loader WordPress plugin up to and including 1.0, distributed by mmanifesto and listed on the WordPress plugin repository. The issue applies to any WordPress installation that has these plugins installed and permits Contributor‑level or higher users to edit content via the plugin’s attributes field.

The CVSS score of 6.4 indicates moderate overall risk. An EPSS score of less than 1% suggests exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to be logged in to WordPress with Contributor or higher privileges and to use the plugin’s attributes input to store malicious code. Once the code is stored, it will run automatically for any user who accesses the affected page, making it a stealthy but client‑side attack vector.