The vulnerability is a Cross‑Site Request Forgery flaw that permits an attacker to inject malicious JavaScript into the plugin’s storage mechanism. When the plugin processes the forged request, the stored payload is later rendered without proper sanitization, resulting in a Stored Cross‑Site Scripting (XSS) vulnerability. This weakness can lead to session hijacking, defacement, or the execution of arbitrary code within the victim’s browser context.

The affected systems are WordPress installations running the ‘Hack me if you can’ plugin version 1.2 or earlier, released by the vendor artanik. No further sub‑version data is supplied, but the risk applies to any installation using a vulnerable plugin instance.

The CVSS score of 7.1 reflects moderate severity, and an EPSS score of less than 1% indicates a very low but non‑zero likelihood of exploitation, with the vulnerability not currently listed in the CISA KEV catalog. The flaw is exploitable through a CSRF attack vector, whereby an attacker can force an authenticated or unauthenticated WordPress user to submit a crafted request that the plugin accepts, embedding malicious JavaScript. An attacker would need to lure a user to visit a malicious page that triggers the forged request, typically by embedding a hidden form or image.