A CSRF flaw in the Autocompleter plugin can be abused to store malicious scripts in the plugin’s data. Once the data is saved, it is rendered in a user’s browser, allowing the attacker to execute arbitrary JavaScript in the context of the site. This weakness is a classic instance of CWE‑352 that can undermine confidentiality, integrity, and availability for users who view the affected content.

The vulnerability affects the Autocompleter plugin developed by nchankov, which is distributed for WordPress. All versions from the earliest release through version 1.3.5.2 are vulnerable. Site owners using any of these versions should treat the plugin as compromised.

The CVSS score of 7.1 indicates a moderate‑to‑high severity that can allow attackers to hijack sessions or deface content. The EPSS score of <1% suggests that, as of the latest data, exploitation attempts remain rare, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack path is a CSRF request performed by an authenticated administrator, injecting a script that is later stored and rendered as part of the plugin’s output.