The plugin contains a CSRF vulnerability that allows an attacker to store malicious JavaScript code in the site’s database. When a legitimate user later visits the site, the injected script runs in their browser, enabling session hijacking, credential theft, or defacement. This stored XSS is the primary impact, potentially affecting all visitors and compromising confidentiality and integrity of user data.

WordPress sites running the Shockingly Big IE6 Warning plugin by mschertel, all releases version 1.6.3 or earlier, are affected. Any installation using these versions is vulnerable.

The CVSS score of 7.1 links the vulnerability to high risk, though the EPSS score of < 1% indicates a low likelihood of exploitation in the wild. Attackers would need to craft a CSRF request, likely by luring an authenticated administrator to a malicious link, to embed the stored script. The issue is not currently listed in the CISA KEV catalog, but it can still be exploited if left unpatched.