The AddFunc Head & Footer Code plugin for WordPress can store arbitrary scripts in its head, body, and footer custom fields without sanitization. Because the plugin outputs these fields directly into page markup, a user with Contributor-level access or higher can inject cross‑site scripting code that runs when a post is previewed or viewed by an administrator. This stored XSS could be used to steal administrative credentials, deface the site, or serve malicious payloads to visitors. The weakness maps to CWE‑79.

All versions of the AddFunc Head & Footer Code plugin up to and including 2.3 are affected. The plugin is available as a WordPress plugin named AddFunc Head & Footer Code and is likely installed on WordPress sites that use it to inject headers, bodies, or footers.

The vulnerability has a CVSS score of 6.4, indicating a medium severity. Exploitation requires an authenticated user with Contributor privileges, so the attack vector is internal. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. An attacker who gains contributor access can embed JavaScript that executes in the context of any administrator previewing or viewing the post, enabling possible credential theft, phishing, or site defacement. Because the script is stored, it persists across page loads until removed.