The Injection Guard WordPress plugin allows an unauthenticated attacker to embed malicious script code in query parameter names. Unsanitized array keys are stored in the plugin’s log option and later output without proper escaping. When an administrator views the log interface, the injected code executes in the admin browser session, giving the attacker the ability to steal credentials, modify site content, or perform additional attacks in the administrator’s context. The weakness is a classic stored XSS flaw (CWE‑79).

WordPress sites running the Injection Guard plugin version 1.2.9 or earlier are affected. The vulnerability exists in all releases up to and including 1.2.9. Any site that has this plugin installed is therefore at risk.

The CVSS score of 7.2 indicates a high risk level. No EPSS score is provided and the vulnerability is not listed in the CISA KEV catalog, but the attack path is straightforward: an attacker crafts a URL containing malicious query parameter names, visits the site to store the payload in the plugin’s database, and later an administrator’s visit to the log page triggers execution. Because the exploit does not require authentication to inject but relies on an unauthenticated request, the barrier to exploitation is low, while the impact on any admin who views the log page is severe.