A Cross‑Site Request Forgery flaw in the Word Freshener plugin allows an attacker to create a malicious request that stores arbitrary JavaScript in the site’s database. When an authenticated or unauthenticated user later views the affected content, the script executes in the user’s browser, leading to session hijacking or defacement. The weakness, classified as CWE‑352, signifies that the plugin does not properly verify that a request originates from a legitimate user context.

The vulnerability affects all releases of the Word Freshener plugin up to and including version 1.3, as distributed by Sourov Amin. WordPress sites that have installed any of these versions and expose the plugin’s administrative interface are at risk.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The CVE is not listed in CISA’s KEV catalog, and no active exploits have been reported. Attackers would likely need to craft a forged HTTP request targeting the plugin’s submission endpoint; the impact depends on the visibility of the stored payload and whether other users view the compromised content. Mitigation remains prudent due to the severity of potential stored XSS.