The Centangle‑Team WordPress plugin suffers from missing nonce validation that allows unauthenticated attackers to forge requests. This weakness is a Cross‑Site Request Forgery (CWE‑352) vulnerability. By tricking an administrator into clicking a crafted link, the attacker can alter the plugin’s settings without credentials. In addition, the plugin fails to sanitize and escape the cai_name_color parameter, enabling the injection of arbitrary JavaScript that is stored and executed every time a page that uses this setting is viewed. The combined effect is that an attacker can remote‑alter site configuration and persistently deliver malicious scripts to all visitors, potentially leading to defacement, credential theft, or session hijacking.

All WordPress installations containing the Centangle‑Team plugin through version 1.0.0 are affected. The CNA vendor is Centangle; the product is Centangle‑Team. No later releases are listed as vulnerable.

The CVSS score of 6.1 classifies this as moderate severity, while the EPSS score of less than 1% indicates a very low probability of exploitation under current threat intelligence. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to lure an administrator into submitting a forged request, which is feasible in social‑engineering scenarios. Once the attack succeeds, the stored XSS component delivers scripts to all site visitors, presenting a persistent client‑side impact without the need for privileged access.