Improper neutralization of input during web page generation in the WordPress MDTF plugin allows attackers to inject malicious scripts that are stored and subsequently rendered whenever affected pages are viewed. This can lead to session hijacking, defacement, or theft of sensitive user data, as the hostile script executes in the context of the visitor’s browser. The flaw is identified as CWE-79.

The vulnerability affects the PluginUs.Net MDTF WordPress plugin, versions up to and including 1.4.0. Any installation of the plugin with a version equal to or less than 1.4.0 is vulnerable.

The CVSS score of 6.5 indicates medium severity. The EPSS score of < 1% suggests a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to submit input that the plugin stores and later renders; the attack is likely carried out remotely through the plugin’s web interface.