The Insert Pages plugin for WordPress contains a stored cross‑site scripting flaw identified as CWE‑79 that allows an authenticated author or higher user to inject arbitrary JavaScript through malicious meta key names. The plugin’s the_meta() function outputs the key name directly into the page without escaping, so any script embedded in a custom field key will execute whenever the affected page is rendered with the [insert page] shortcode. This could affect any visitor to that page.

The affected product is the Insert Pages WordPress plugin distributed by figureone. All releases through version 3.11.4, inclusive, are vulnerable. The flaw appears in the source code around lines  and is triggered when the [insert page='ID' display='all'] shortcode renders a page that contains a malicious custom field key.

The vulnerability can be exploited only by authenticated users with author level or higher privileges because it requires the ability to create or edit custom field keys. The CVSS score of 6.4 indicates moderate severity, while the EPSS score of < 1 % reflects a very low but non‑zero likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. When present, the attack surface is limited to active WordPress sites that allow authors to add custom fields and use the Insert Pages shortcode.