The plugin allows a Cross‑Site Request Forgery (CSRF) flaw that permits an attacker to store arbitrary script payloads in the plugin’s data fields. When that data is displayed to site visitors, the malicious scripts are executed in their browsers, enabling session hijacking, data theft, defacement or other browser‑side compromises. The weakness corresponds to the standard CSRF fault (CWE‑352).

WordPress sites that have the Nazmul Ahsan MDC YouTube Downloader plugin installed are affected when the plugin version is 3.0.0 or earlier. All affected sites host the plugin through the WordPress plugin repository or other distribution channels.

The CVSS score of 7.1 indicates a medium‑to‑high risk. The EPSS score is less than 1 %, suggesting that real‑world exploits are currently scarce. The vulnerability is not listed in CISA’s KEV catalog. The likely attacker path is inferred: by creating a forged request to the plugin’s endpoint, an attacker can push a malicious script that persists in the database and runs for any visitor who loads the affected page. The risk is limited to sites where the plugin is enabled and users are allowed to view the stored data.