This vulnerability arises from a missing CSRF token when creating lyric entries, allowing an attacker to insert arbitrary JavaScript that is persistently stored within the WordPress database. Because the script runs in the context of any visitor to the lyrics page, it can steal session cookies, hijack user accounts, or deface the site. The weakness is classified as CWE‑352, a Cross‑Site Request Forgery that leads to Stored XSS.\n

The issue affects the WP Lyrics plugin developed by zetxek, versions starting from the earliest available release up through 0.4.1. All installations of the plugin before version 0.4.2 are potentially vulnerable.\n

The CVSS score of 7.1 indicates a moderate‑to‑high severity, and the EPSS value of less than 1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would send a crafted HTTP request that bypasses CSRF protection to insert malicious content; once stored, every user who views the affected page will execute the injected script. Because no authentication is required to perform the action, any visitor can trigger the attack by visiting a specially crafted URL.