A Cross‑Site Request Forgery flaw in the wpSOL WordPress plugin allows an attacker to submit a request that the plugin accepts and stores malicious script. The stored script is later displayed as part of the site’s content, creating a Stored XSS condition for users who view that content.

WordPress sites using the wpSOL plugin from vendor koter84 with any version up to and including 1.2.0 are affected.

The CVSS score of 7.1 indicates a high potential for serious impact and the EPSS score is less than 1 %, showing a low probability of exploitation at present; the vulnerability is not listed in CISA KEV. The attack vector is a CSRF request; based on the description it is inferred that the plugin does not fully validate the origin of incoming requests, allowing the attacker’s crafted request to be accepted and the malicious content stored.