The Mandatory Field plugin for WordPress allows authenticated administrators to store malicious scripts in the plugin’s settings, which are then rendered on any page that includes those settings. The vulnerability is a classic stored XSS flaw (CWE‑79) that can lead to session hijacking, defacement, or the execution of arbitrary code within the context of site visitors. No external file downloads or network exploits are required; the weakness resides in the server‑side processing of admin input.

The problem exists in all releases of the Mandatory Field plugin up to and including version 1.6.8. It impacts WordPress multi‑site installations or single sites where the unfiltered_html capability is turned off, and only attackers who can log in as administrator or higher can abuse the flaw.

The CVSS score of 4.4 indicates moderate severity. The advisory does not list an exploitation probability score, and the issue is not in the CISA KEV catalog. The likely attack vector is an authenticated administrator performing normal configuration changes; exploitation requires no additional lateral movement or privilege escalation beyond the existing admin role.