CVE-2026-2305 is a stored cross-site scripting vulnerability in the AddFunc Head & Footer Code WordPress plugin (up to version 2.3). The vulnerability arises from the plugin outputting the `aFhfc_head_code`, `aFhfc_body_code`, and `aFhfc_footer_code` post meta values without sanitization or escaping. Although the plugin limits its metabox and save handler to administrators, it fails to use `register_meta()` with an `auth_callback` to restrict access to these meta keys. Consequently, authenticated users with Contributor-level privileges or higher can inject arbitrary JavaScript via the Custom Fields interface, which executes in the context of administrators when they preview or view the affected post.

This vulnerability allows authenticated users with Contributor-level access or higher to perform stored cross-site scripting attacks that execute arbitrary scripts in the context of administrators. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed by administrators. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, and privileges required at the contributor level.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Contributor-level access and above to trusted users only and consider disabling or limiting the use of the AddFunc Head & Footer Code plugin. Monitor for updates from the vendor or security advisories for a patch or official mitigation.