The vulnerability allows an authenticated user with contributor or higher level access to inject arbitrary JavaScript through the rank_math_description custom field. When the injected content is displayed, the script executes in the browsers of anyone who visits the affected page. Typical XSS exploitation could involve actions such as stealing session data, defacing content, or redirecting users to malicious sites; these outcomes are inferred. The flaw results from insufficient input sanitization and lack of output escaping, highlighting that it could compromise the confidentiality and integrity of the site’s content, though these effects are also inferred. This vulnerability corresponds to CWE‑79.

The flaw exists in the flatboy FlatPM – Ad Manager, AdSense and Custom Code WordPress plugin in all releases with a version number of 3.2.2 or earlier.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of under 1 percent suggests a very low probability of exploitation at the time of analysis. The flaw is not listed in the CISA KEV catalog, and exploitation requires authenticated access, though users with contributor authority are common on many sites. The most likely attack path requires the attacker to first gain contributor‑level access, add malicious content to the custom field, and then rely on any site visitor to trigger the script when viewing the affected page.