The Responsive Header plugin for WordPress is vulnerable to stored cross‑site scripting because several settings parameters are written without proper sanitization or escaping. An attacker who can log into the WordPress admin area with administrator privileges can modify these settings to embed malicious JavaScript, which will run whenever another user views a page that includes the affected settings. This flaw allows attackers to deface content, steal session cookies, or redirect users to phishing sites.

The vulnerability exists in all versions of the Responsive Header plugin released by the vendor mehtevas, up to and including version 1.0. The issue is confined to multisite WordPress installations where the unfiltered_html capability has been disabled, meaning that only network‑wide or site‑wide administrators who can edit plugin settings are at risk.

With a CVSS score of 4.4 the flaw is considered moderate. Its EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild, and it is not listed in CISA’s KEV catalog. However, because it requires administrator access, any compromised admin account could leverage the flaw immediately, making it prudent to address the issue as soon as reasonably possible.