The Smart Agenda plugin contains an improper neutralization of user input when generating web pages, leading to a stored cross‑site scripting flaw. Because the attack leverages a CSRF‑triggered request, an attacker can inject JavaScript that is persisted in the site’s content. When a victim later loads the affected page, the injected script executes in the victim’s browser, potentially compromising session data, defacing the site, or redirecting the user to malicious destinations. The vulnerability is a typical CWE‑79 stored XSS that endangers confidentiality, integrity, and availability.

The flaw affects the WordPress Smart Agenda plugin released by Smart Agenda, specifically versions up to and including 4.7. Any WordPress installation that has this plugin installed and has not been upgraded beyond 4.7 is impacted.

The CVSS score of 7.1 indicates a substantial risk, while the EPSS score of less than 1 % suggests that exploitation is currently uncommon. The flaw is not listed in CISA’s KEV catalog. Attackers would need to craft a CSRF request that includes malicious input and deliver it to an authenticated user or an administrator visiting the affected page. Successful exploitation would leave the malicious script stored until removed, giving the attacker persistent access to any user who views the compromised content.