The Pagerank Tools plugin for WordPress contains a stored cross‑site scripting flaw that is triggered by a cross‑site request forgery attack. The flaw arises from the pr_save_settings() function lacking nonce validation and performing insufficient input sanitization. An attacker who can persuade an administrator to submit a forged request can inject malicious scripts that execute for every user who later visits the plugin’s settings page, compromising confidentiality and integrity of the site’s data. This weakness is identified as CWE‑352.

All installations of the Pagerank Tools plugin from its initial release up to and including version 1.1.5 are affected. The vendor listed is mahype:Pagerank Tools.

The CVSS score of 6.1 indicates a moderate to high level of risk. The EPSS score of less than 1% suggests that so far the vulnerability has a very low exploitation probability, and it is not cataloged in the CISA KEV list. The likely attack vector requires an unauthenticated visitor to trick an administrator into clicking a malicious link or otherwise triggering a crafted HTTP request that bypasses the plugin’s missing CSRF protection. Because the vulnerability leads to stored XSS, it can affect any user who logs into the site after the injection. The vulnerability can be exploited remotely without requiring privileged credentials, making the threat surface broad for sites that use this plugin.