The Head Meta Data plugin for WordPress contains a stored cross‑site scripting flaw in the ‘head‑meta‑data’ post meta field. Owing to missing input sanitization and output escaping, an authenticated user with contributor or higher privileges can inject arbitrary web scripts that are stored and then executed within the browsers of any visitor who loads a page that renders the affected meta field. The vulnerability thus permits the execution of malicious JavaScript in the context of site visitors.

WordPress sites that have installed the Head Meta Data plugin from the specialk vendor and are running any version up to and including 20251118 are impacted. The flaw manifests whenever the plugin renders the stored post meta value on a page; thus any page that uses the plugin’s functionality can be used as an injection vector.

With a CVSS base score of 6.4, the vulnerability is considered moderate. The EPSS score indicates a very low likelihood of exploitation, and the vulnerability is not included in the CISA KEV catalog. Because the attack requires authorised contributor‑level or higher access, exploitation depends on the attacker first gaining such privileges within the site. Once injected, the malicious script runs in the visitor’s browser but no further outward impact is described in the public report.