The Responsive Plus WordPress plugin before version 3.4.3 exposes an AJAX action that accepts the parameter content_rech_data without validating the user’s authentication or the content's safety. An attacker can send an unauthenticated request to this AJAX endpoint and embed any shortcode, effectively executing arbitrary code on the site. This allows the attacker to compromise the confidentiality, integrity, and availability of the website by running malicious commands or injecting harmful content.

WordPress sites that have the Responsive Plus plugin installed with a version earlier than 3.4.3 are affected. No specific vendor name is provided, but the vulnerability applies to all installations using that plugin version.

The CVSS score of 6.5 indicates a moderate risk, while the EPSS score is below 1 %, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web‑based, requiring no credentials, and the vulnerability could be exploited by any user with internet access to the site.