The Bas Matthee LSD Custom taxonomy and category meta plugin versions up to 1.3.2 suffer from an improper input neutralization vulnerability during web page generation, classified as Cross-site Scripting (XSS). This vulnerability allows attackers to inject malicious scripts that execute in the context of users viewing affected pages. The CVSS 3.1 score is 7.1 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability at a low level. There is no vendor advisory or patch information provided at this time.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially allowing theft of user data, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability at a limited level. The attack requires user interaction and can be performed remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with this plugin and consider disabling or restricting its use in environments where XSS risks are critical. Monitor official sources for updates or patches from the vendor.