The Virtual Bot WordPress plugin up to version 1.0.0 contains a CSRF flaw that allows an attacker to inject malicious JavaScript which is stored and later executed whenever a page is viewed. The vulnerability is a classic Stored Cross‑Site Scripting, identified by CWE‑352. If an attacker successfully submits the payload through a CSRF request, the script will run under the context of any authenticated or even unauthenticated user who views the affected content, potentially leaking cookies, hijacking sessions, or defacing the site.

All installations of Ofek Nakar Virtual Bot plugin for WordPress with a version of 1.0.0 or earlier are affected. The vulnerability applies to every release from the initial version up through and including 1.0.0.

The CVSS score of 7.1 indicates moderate to high severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation at the present time. The flaw is not listed in CISA KEV. Likely exploitation requires an attacker to craft a CSRF request that an authenticated user will unknowingly accept; once executed, the stored script will affect all users who view the compromised page.