The UpDownUpDown WordPress plugin contains a cross‑site request forgery flaw that allows an attacker to submit a malicious payload through the voting interface. Because the request is accepted without verification of its origin, the payload is stored by the application and later executed in the browsers of site visitors, resulting in a stored cross‑site scripting vulnerability.

All installations of the UpDownUpDown plugin from the initial release through version 1.1, developed by Dave Konopka, are affected. The flaw is present in every release in this range and can be triggered by any WordPress site that includes these plugin versions.

The CVSS score of 7.1 indicates a moderate severity, while the EPSS score of less than 1 % suggests a low probability of exploitation in the immediate future. The vulnerability is not listed in the CISA KEV catalog, implying no known large‑scale exploitation to date. The likely attack vector involves an adversary crafting a forged request to the voting endpoint, leveraging a user’s authenticated session to store the malicious script, which is then rendered when other users view the affected content.