The GDReseller plugin for WordPress contains a cross‑site request forgery flaw that allows an attacker to submit malicious data that is stored within the website. Because the plugin lacks proper CSRF protection, a forged request can inject a payload that is later rendered as HTML or JavaScript in the context of the site. This stored XSS can execute arbitrary code in the browsers of any visitor, enabling session hijacking, defacement, or further exploitation. The weakness is classified as CWE‑352.

GDReseller v1.6 and all earlier releases for WordPress. Any site that has installed the plugin without updating beyond 1.6 is vulnerable. The vulnerability is not tied to a specific base version other than the stated maximum.

The CVSS base score of 7.1 indicates a high severity. The EPSS score of less than 1 % suggests a low probability of exploitation at the moment, and the issue is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is that an attacker crafts a forged request that an authenticated user unknowingly submits, allowing the attacker to install a script that is then executed by all visitors to the site. The impact is potentially widespread but requires user interaction to initiate the stored payload.