The SH Contextual Help plugin for WordPress contains a vulnerability that permits Cross‑Site Request Forgery due to missing or incorrect nonce validation in its dashboard widget handling. An unauthenticated attacker can forge a request to update the plugin’s settings, allowing the injection of arbitrary JavaScript. The injected script is stored in the widget data and will execute in the browser of any visitor to the dashboard, resulting in stored cross‑site scripting, which can facilitate defacement, credential theft, or session hijack.

The vulnerability affects the SH Contextual Help plugin version 3.2.1 and all earlier releases, distributed by the vendor Samhoamt. All WordPress sites that have this plugin installed and have not upgraded beyond version 3.2.1 are potentially vulnerable.

The CVSS v3 base score of 6.1 classifies the flaw as moderate. The EPSS score of less than 1% indicates a low current probability of exploit. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to persuade a site administrator to perform a specific action, such as clicking a crafted link, making the attack non‑automatic and dependent on social engineering. Successful exploitation would grant the attacker stored XSS capabilities, compromising the confidentiality, integrity, and availability of the affected website for all users that view the compromised dashboard widget.