Technical impact
The WM JqMath plugin contains a stored Cross‑Site Scripting flaw in the 'style' attribute of the [jqmath] shortcode. The plugin concatenates the raw attribute value straight into an HTML style tag without escaping, allowing an attacker to embed malicious JavaScript. If executed, the injected code runs in the context of any user who views the affected page, permitting session hijack, credential theft, defacement, or further lateral movement within the site. This vulnerability falls under Code Injection and Output Encoding weaknesses.
Affected Systems
The flaw affects the Webmindpt WM JqMath plugin for WordPress in all releases up to and including version 1.3. Any WordPress installation that has this plugin and allows users with Contributor or higher capabilities to post content is potentially exposed.
Risk and Exploitability
The CVSS v3.1 score is 6.4, indicating medium severity with a medium impact rating (confidentiality and integrity). EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no current public exploits. The exploit requires authenticated access with at least Contributor rights and relies on the ability to insert a [jqmath] shortcode in post content. Once the attacker supplies a malicious 'style' value, the code is stored and later executed automatically when visitors load the page.
