The vulnerability allows an unauthenticated attacker to inject arbitrary script into web pages through the HTTP_USER_AGENT header. Because the plugin fails to sanitize the header and to escape output, the injected script is permanently stored and subsequently executed whenever an administrator views a page. This is a classic stored cross‑site scripting flaw (CWE‑79) that can lead to credential theft, session hijacking, or defacement of the website.

WordPress sites running the Quttera ThreatSign – Web Malware Scanner plugin, all releases up to and including version 4.1.0.48. The plugin can be present on any installation that has not yet applied the security update released after that version.

The flaw receives a CVSS score of 7.2, indicating high severity, and the EPSS score is not available, so the risk must be gauged mainly from CVSS and from the fact that it is unauthenticated. A directed malicious HTTP request that includes a crafted User‑Agent header can deliver the payload; the attack does not require prior privilege or user interaction. The vulnerability is not listed in the CISA KEV catalog at this time, but the combination of high CVSS and broad exposure makes it a priority for patching.