The Wp Js Detect plugin for WordPress suffers from a missing or incorrect nonce check in its plugin_settings function. As a result, an attacker can submit a forged request that updates the plugin’s notification text or CSS settings. Because the plugin echoes these values directly on the front‑end without escaping, the injected content can contain arbitrary HTML or JavaScript, potentially defacing the site or delivering malware to visitors.

Any WordPress installation that has Wp Js Detect version 1.0.9 or earlier installed.

The vulnerability carries a CVSS score of 4.3, indicating moderate severity. EPSS is less than 1% and the flaw is not listed in CISA KEV, suggesting no publicly known exploitation. Based on the description, it is inferred that the attack vector likely involves social engineering, such as convincing a site administrator to click a crafted link or submit a forged form. Because the plugin echoes the injected notification text and CSS without escaping, the payload can contain arbitrary JavaScript, enabling script execution on the front‑end. This can be used for defacement, phishing, or delivering malicious code to site visitors. No remote code execution or privilege escalation is possible beyond the scope of the injected content, but the requirement for an administrator’s interaction lowers the barrier for an attacker with social‑engineering skills.