The vulnerability is a Cross‑Site Request Forgery that allows an attacker to submit data to the Quote Tweet plugin that is stored and later rendered in the site’s pages. The stored content can contain malicious scripts, which will execute in the context of the administrator’s browser session, potentially exposing sensitive cookies, credentials, or performing actions on behalf of the admin.

The WordPress Quote Tweet plugin by bozdoz, versions up to and including 0.7, is affected. All installations that have this plugin active are at risk.

The CVSS score of 7.1 indicates substantial impact when exploited. With an EPSS score of less than 1% and no listing in the CISA KEV catalog, the likelihood of widespread exploitation is currently low, but the risk exists if an attacker can trick an admin user into performing a forged request. An attacker would need user interaction, such as a malicious link or form, to insert the XSS payload and then rely on a later page view to trigger the script.