The WP Hallo Welt plugin for WordPress contains a Cross‑Site Request Forgery vulnerability that allows unauthenticated attackers to forge requests to the ‘hallo_welt_seite’ function. Because nonce validation is missing or incorrect, an attacker can trick a site administrator into unknowingly submitting a crafted request that changes plugin settings and injects arbitrary JavaScript. This results in stored Cross‑Site Scripting that can execute in the browsers of any user who visits affected pages, compromising confidentiality, integrity, and availability of the site content.

WordPress installations running the WP Hallo Welt plugin version 1.4 or earlier are affected. The vulnerability exists in all builds through tag 1.4 inclusive, and any site deploying the plugin at that version or lower is vulnerable.

The CVSS score of 6.1 indicates a moderate severity, and the EPSS score of < 1% suggests that exploitation is currently unlikely, though the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a CSRF request where the attacker lures a logged‑in administrator to click a malicious link or submit a forged form. Given the missing nonce and unsanitized input, success would result in persistent XSS, allowing attackers to steal session cookies, deface websites, or spread malware to site visitors.