The LinkedIn Resume plugin for WordPress contains a missing or incorrect nonce check in the linkedinresume_printAdminPage() function. This flaw allows an attacker, without authentication, to issue a forged request that updates the plugin’s settings and stores a malicious script. That stored script is then executed when a site administrator visits the affected admin page, enabling cross‑site scripting in the context of privileged users and potentially allowing disclosure of sensitive data, defacement, or session hijacking. The underlying weakness is identified as Cross‑Site Request Forgery (CWE‑352).

Any WordPress site running the LinkedIn Resume plugin version 2.00 or earlier. The affected vendor is bondnono and the product name is LinkedIn Resume.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score of less than 1% suggests a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers must convince a site administrator to click a malicious link or otherwise trigger the forged request, but once the request is sent, the stored script is automatically executed. While the likelihood of exploitation is low, the impact on an administrator’s session can be significant once executed, making it important to mitigate as soon as possible.