The WP Tab Widget plugin contains a contributor cross‑site scripting flaw that allows malicious input to be rendered on the site’s front‑end pages. This CWE‑79 issue can lead to unauthorized script execution in the users’ browsers, potentially enabling cookie theft, session hijacking, or the injection of additional malicious content. The flaw is present in all versions up to and including 1.2.11.

The vulnerability affects the MyThemeShop WP Tab Widget plugin for WordPress. All installations running version 1.2.11 or earlier are vulnerable; the affected product is the standard WP Tab Widget where contributors can add tab content through the admin interface.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is user‑supplied input in contributor‑provided tab content that is not properly sanitized before rendering, allowing an attacker to embed arbitrary JavaScript. Exploit requires the attacker to have access to the contributor UI or to trick an administrator into accepting malicious content, making it a somewhat low‑to‑moderate ease of exploitation but with potentially high impact on affected users.