CVE-2026-0608 is a stored cross-site scripting vulnerability in the specialk Head Meta Data WordPress plugin. It arises from insufficient input sanitization and output escaping of the 'head-meta-data' post meta field. Authenticated attackers with contributor or higher privileges can inject arbitrary web scripts that execute on page load for any user viewing the affected content. The vulnerability impacts all versions up to 20251118. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact.

An attacker with contributor-level access or higher can inject malicious scripts into WordPress pages via the vulnerable plugin. These scripts execute in the context of users visiting the infected pages, potentially leading to theft of cookies, session tokens, or other sensitive information. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider removing or disabling the Head Meta Data plugin to prevent exploitation.