The WP‑Walla plugin does not validate nonces on its settings page, allowing an unauthenticated user to submit a forged request that an administrator may unknowingly execute. Input supplied in that request is saved without proper sanitization, and when the plugin later outputs the stored setting, the embedded script runs in visitors’ browsers. This stored cross‑site scripting, enabled by a CSRF weakness (CWE‑352), gives an attacker a powerful vector to inject arbitrary code into the site and potentially manipulate or deface content for all users.

WordPress websites that have the WP‑Walla plugin from vendor baronen, in versions 0.5.3.5 and all earlier releases.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of less than 1% shows that actual exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to lure an administrator into clicking a crafted link or submitting a form that triggers the settings update, after which the injected script becomes part of the page content for all visitors.