The WMF Mobile Redirector plugin allows an attacker who has Administrator‑level access to inject arbitrary JavaScript into the plugin’s settings. Because the plugin fails to sanitize or escape the input, the injected code is stored and later executed whenever a user loads a page that includes the affected setting. This stored XSS can lead to session hijacking, defacement, or the injection of malicious content to other site visitors.

The vulnerability exists in the WMF Mobile Redirector WordPress plugin in all releases up to and including version 1.2. Any WordPress site that has this plugin installed and provides at least one administrative user can be impacted.

The CVSS score is 4.4, indicating moderate severity. The EPSS score is below 1 %, suggesting a low frequency of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a valid administrator account; an unauthenticated attacker cannot exploit it directly. Consequently, the real‑world risk is limited to sites where administrator credentials are compromised or weak, but the injected script can affect all users who view the affected pages.