The JSM Show Post Metadata WordPress plugin versions older than 4.9.1 fails to escape a post meta key when it is rendered inside an inline event‑handler attribute in an admin meta box. This flaw allows a user with contributor privileges or higher to inject arbitrary JavaScript that will execute in the browser context of any higher‑privileged user who later views the affected post. The stored script runs with the victim’s session state, enabling potential theft of authentication cookies, session hijacking, or execution of additional malicious payloads, thereby compromising the confidentiality and integrity of the site’s administration area.

Any WordPress installation that uses the JSM Show Post Metadata plugin version 4.9.0 or earlier is affected. The vulnerability is limited to the WordPress admin interface where post metadata is edited. Sites that have enabled contributors or higher roles and have the plugin installed may be able to perform the injection.

The flaw carries a CVSS score of 6.8. The EPSS indicates a very low probability of exploitation (<1%), and the vulnerability is not listed in the CISA KEV catalog. However, because contributors or administrators can directly input meta keys, the attack vector is straightforward: an authenticated user with at least contributor role can craft a malicious meta key, save it, and trigger script execution in the session of any higher‑privileged user who later accesses the same post. The impact is confined to the browser session of privileged users, but it can result in credential theft or elevated privileges if the injected script performs DOM‑based attacks.