The WP Content Permission plugin for WordPress permits an authenticated attacker, specifically users with Administrator or higher privileges, to store and inject arbitrary JavaScript code into plugin configuration pages. The injection occurs through the 'ohmem-message' parameter, which is neither sanitized nor escaped when saved, making the content persist and execute whenever any user accesses the affected page. This weakness is classified as CWE‑79 and can lead to session hijacking, defacement, or theft of credentials if a victim interacts with the compromised page.

Vulnerable versions of the WP Content Permission plugin are all releases up to and including 1.2. The plugin is maintained by orenhav for WordPress sites and is commonly installed on environments that allow administrative configuration via the WordPress dashboard.

The vulnerability carries a CVSS score of 4.4, indicating moderate severity, and an EPSS score of less than 1 %, reflecting a very low probability of exploitation. It is not identified as a known exploited vulnerability by CISA. No known public exploits are reported, and the attack requires authenticated access with administrative rights. Consequently, the risk is limited to sites that have compromised admin accounts or use compromised credentials, but the potential impact of in‑browser code execution remains significant if such conditions are met.