The Meta Data and Taxonomies Filter plugin for WordPress allows an attacker to store malicious JavaScript through the unsanitized 'vars' parameter. The injected script is persisted in the site’s database and executes whenever a page containing the [meta_data_filter_results] shortcode is viewed, enabling session hijacking, defacement, or malware delivery. This is a classic client‑side code injection that directly compromises the browser context of users.

WordPress sites that use the realmag777 Meta Data and Taxonomies Filter plugin version 1.4.1 or earlier and contain the [meta_data_filter_results] shortcode in any published page or post. Any public or private page that incorporates that shortcode is susceptible if the vulnerable plugin version is installed.

The CVSS score of 7.2 classifies this issue as high severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. An unauthenticated attacker can exploit it by crafting a request to the plugin’s endpoint that accepts a 'vars' parameter without needing special privileges. Because the flaw only requires the presence of the shortcode, a broad spectrum of sites running older plugin versions is at risk, making the attack surface wide.