CVE-2026-2305 is a stored cross-site scripting vulnerability in the AddFunc Head & Footer Code WordPress plugin (up to version 2.3). The plugin outputs the post meta values `aFhfc_head_code`, `aFhfc_body_code`, and `aFhfc_footer_code` without sanitization or escaping. Although the plugin limits its metabox and save handler to administrators, it does not use `register_meta()` with an `auth_callback` to protect these meta keys. This allows authenticated users with Contributor-level permissions or higher to inject arbitrary JavaScript via the WordPress Custom Fields interface. The injected scripts execute when an administrator previews or views the affected post, potentially compromising the administrator's session or site integrity.

An attacker with Contributor-level or higher access can inject malicious scripts that execute in the context of an administrator's browser when they preview or view a post. This can lead to unauthorized actions performed with administrator privileges, data theft, or site compromise. The vulnerability does not allow unauthenticated exploitation and does not impact availability. The CVSS score of 6.4 reflects a medium severity with low attack complexity and limited privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level user capabilities to prevent unauthorized meta field modifications or disable the plugin if possible. Monitor for plugin updates that address this vulnerability and apply them promptly once released.