The ECT Add to Cart Button plugin for WordPress contains a CSRF flaw that permits an attacker to craft a forged request, resulting in malicious script being stored in the plugin’s data. When other site visitors load that content, the stored script executes in their browsers, leading to a stored Cross‑Site Scripting vulnerability. The injected payload can hijack user sessions, steal sensitive data, or deface the site.

All releases of the etemplates ECT Add to Cart Button plugin through version 1.4 are affected. The flaw exists in the plugin’s handling of user‑generated input via the add‑to‑cart functionality, and the attack can be performed by sending a crafted request to a site that has the plugin installed. Updating to a patched release, if available, or uninstalling the plugin eliminates the risk.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% shows that exploitation is relatively unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. Legitimate exploitation requires a logged‑in user to be tricked into visiting a malicious link or form. Once exploited, the attacker can execute arbitrary code in the victim’s browser context, compromising confidentiality and potentially enabling further attacks.