A Cross‑Site Request Forgery flaw in the syedamirhussain91 Custom Post custom‑post‑type‑gui plugin allows an attacker to submit a crafted request that stores malicious JavaScript in a custom post. Because the plugin does not verify proper CSRF tokens, a logged‑in administrator or any privileged user can unknowingly save the injected script. Subsequent visitors to the affected post will execute the script in their browsers, potentially exposing session cookies, defacing the site, or facilitating further attacks.

WordPress installations that use the Custom Post plugin up to and including version 1.0. The flaw is confined to this vendor’s product; no other WordPress core components or plugins are directly implicated.

The CVSS score of 7.1 places the vulnerability in the high‑severity range. Although the EPSS score is below 1%, indicating low current exploitation probability, the vulnerability is publicly exploitable if the site remains running the affected plugin. The lack of a KEV listing does not diminish the risk; the attack requires only the ability to craft a malicious request, which can be performed from the public internet. Once stored, the XSS runs with the context of any user who views the post, enabling theft of sensitive information or hijacking of user sessions.