The CSV Sumotto plugin for WordPress incorporates the PHP superglobal $_SERVER['PHP_SELF'] directly into page output without sanitization or escaping. This omission allows an unauthenticated attacker to inject arbitrary JavaScript that will run in the browsers of any user who follows a crafted link. The injected code can steal session cookies, deface content, or redirect victims to malicious sites, thereby compromising the confidentiality, integrity, and availability of the user experience.

WordPress sites that have the CSV Sumotto plugin installed, specifically all versions up to and including 1.0. The vulnerability exists in the settings page and any other page where the plugin echoes PHP_SELF.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of less than 1% reflects a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA KEV. Nevertheless, an attacker can exploit it via a single click if they can convince a user to visit a maliciously crafted URL. With no authentication requirement, the scope is limited to the target site but any user that visits the vulnerable page can be affected.