The Header Footer Script Adder plugin for WordPress allows an authenticated user with author-level access or higher to store arbitrary JavaScript in the "asm_code" snippet meta field. The stored script is then rendered on every page that includes the snippet, causing it to execute in the browsers of users who view the affected pages. This vulnerability is a CWE‑79 stored cross‑site scripting flaw stemming from insufficient input sanitization and output escaping.

All WordPress installations running mahethekiller’s Header Footer Script Adder plugin version 2.1 or earlier are affected. The impact is limited to sites where an authenticated user possesses author‑level permissions or higher and the plugin is active on public pages.

The CVSS score of 6.4 translates to a medium severity. The EPSS score of less than 1% indicates a low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. An attacker must have author‑level credentials to inject code. Once such a script is stored, any visitor to pages that display the snippet will have the malicious script executed in their browser, presenting a typical XSS risk.