The WP Meteor Website Speed Optimization Addon plugin for WordPress contains a flaw in its frontend_rewrite function that fails to sanitise or escape the placeholder content "WPMETEOR[N]WPMETEOR". Untrusted input such as comment submissions can be used to store JavaScript code in the system. When a page containing the placeholder is rendered, the stored script executes in the browsers of any visitor, giving the attacker the ability to hijack sessions, exfiltrate data or deliver further malicious payloads. This is a classic client‑side injection weakness identified as CWE‑79.

WordPress sites that have installed the WP Meteor Website Speed Optimization Addon plugin in any version up to and including 3.4.16. The issue applies to all WordPress environments that support this plugin; no specific WordPress core version is singled out. All installations running a vulnerable plugin version are exposed.

The vulnerability has a CVSS score of 6.1, indicating moderate severity. The EPSS score is very low (<1%), and the exploit is not listed in the CISA KEV catalog. The attack surface is remote, as any external input that feeds the frontend_rewrite logic can be abused, and the flaw is exploitable by unauthenticated users, so an attacker needs only to craft a malicious comment or form submission.