A Cross‑Site Request Forgery flaw in the Kapost‑Byline WordPress integration lets an attacker force a logged‑in user to submit a crafted request, resulting in the injection of arbitrary script that is permanently stored in the site’s content. Once stored, the malicious code will execute whenever a browser loads affected pages, enabling session hijacking, defacement, or other client‑side attacks. The weakness is identified as CWE‑352.

The Kapost integration plugin for WordPress, versions up to and including 2.2.9, is affected. All earlier releases are also vulnerable since no earlier fixed version is specified.

The vulnerability carries a CVSS score of 7.1, indicating high severity. The EPSS score is under 1 %, suggesting that exploitation is currently rare and the attacker must craft a convincing CSRF vector, typically by luring an authenticated user to a malicious site. The issue is not listed in the CISA KEV catalog. Thus, while the impact is significant if successfully exploited, the likelihood of an active attack remains low at present, but could rise if the plugin is widely used without additional CSRF protections.