The Wp Js Detect plugin for WordPress suffers from a missing or incorrect nonce check in its plugin_settings function. As a result, an attacker can submit a forged request that updates the plugin’s notification text or CSS settings. Because the plugin echoes these values directly on the front‑end without escaping, the injected content can contain arbitrary HTML or JavaScript, potentially defacing the site or delivering malware to visitors.

Any WordPress installation that has Wp Js Detect version 1.0.9 or earlier installed.

The vulnerability carries a CVSS score of 4.3, indicating moderate severity. EPSS is less than 1% and the flaw is not listed in CISA KEV, suggesting no publicly known exploitation. Based on the description, it is inferred that the attack vector likely involves social engineering, such as convincing a site administrator to click a crafted link or submit a forged form. While the impact is limited to the injection of non‑executed content on the front‑end, it can still be used for defacement, phishing or the delivery of malicious scripts to site visitors. No remote code execution or privilege escalation is possible, but the requirement for an administrator’s interaction lowers the barrier for an attacker with social‑engineering skills.