This vulnerability is a Cross‑Site Request Forgery flaw in the Ned Curated Search plugin that permits an attacker to submit a crafted request which causes the plugin to store malicious JavaScript. The injected script is later rendered in the context of the site, allowing an attacker to execute arbitrary client‑side code, deface content, steal session data, or redirect users to malicious sites. The CVSS score of 7.1 reflects its moderate‑to‑high severity due to the potential for widespread impact once the script is stored.

All installations of the Ned Curated Search WordPress plugin with version 1.2 or earlier are affected. The issue applies globally across all supported WordPress environments that have the plugin enabled.

The CVSS score of 7.1 categorizes this as a high‑risk vulnerability, yet the EPSS score of less than 1% indicates a very low short‑term likelihood of being exploited in the wild. The attack path is primarily through a forged request that an authenticated user would unknowingly send, after which the stored XSS payload becomes active for all subsequent visitors. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently known to be actively exploited.