The Social Media WPCF7 Stop Words plugin suffers from missing or incorrect nonce validation in its smWpCfSwOptions() function. An attacker who can trick a site administrator into submitting a request can change the plugin's settings and inject malicious web scripts. The impact is that the attacker gains execution capability within the website’s context without requiring any authentication beyond a forged request. CWE‑352"}

All WordPress sites running the Social Media WPCF7 Stop Words plugin, version 1.1.3 or earlier. The vulnerability applies to any installation that has not upgraded beyond 1.1.3, affecting user accounts with administrator privileges who have access to the plugin’s settings page.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to lure an administrator into performing a forged action—most commonly a phishing link that triggers the plugin settings update without correct nonce verification. No additional prerequisites are noted beyond the ability to trick an admin user into clicking a malicious URL.