The Zoorum Comments plugin for WordPress has a missing or incorrect nonce check in the zoorum_set_options() function. Because of this, an attacker can forge a request and trick an administrator into triggering the update settings action. The forged request allows the attacker to inject arbitrary JavaScript into the plugin’s settings, which is then persisted and served to every visitor of the site. The flaw combines a Cross‑Site Request Forgery weakness (CWE‑352) with Stored Cross‑Site Scripting (CWE‑79), giving the attacker the ability to compromise the confidentiality and integrity of data seen by all users of the affected site and potentially take control of user sessions. The impact is that any user browsing the compromised site could execute malicious code, leading to defacement, credential theft or further lateral movement on the host system.

WordPress sites running the Zoorum Comments plugin version 0.9 or earlier are affected. The vulnerability is present in all releases up to and including 0.9, regardless of the WordPress core version. Site administrators who have the plugin active and are logged in need to be aware of the risk because the vulnerability requires an admin to submit a POST request that updates the plugin settings. No operating systems or hosting environments are specifically singled out, but any environment that runs WordPress with this plugin is at risk.

The CVSS score of 6.1 indicates a medium severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. However, the attack still requires an unauthenticated attacker to lure an administrator into clicking a malicious link or visiting a crafted page. Once the request is forged, the settings update writes the attacker’s script to the database, leaving a persistent payload that runs for all site visitors. The relatively low exploit probability does not eliminate the risk because the resulting stored XSS can enable data exfiltration, session hijacking, or the installation of backdoors for long‑term compromise. Security teams should treat the flaw as noteworthy, especially on high‑profile or sensitive WordPress sites.