A cross‑site request forgery flaw in the MartijnScheijbeler Social Analytics WordPress plugin allows an attacker to inject a malicious script that is stored and later rendered to other users, resulting in a stored XSS condition. The weakness is formally classified as CWE‑352. While the description does not state the exact defensive gap, it appears that the plugin does not enforce a sufficient anti‑CSRF check, and the stored data accepts script code without proper sanitization, which is required for a stored XSS mitigation.

All installations of the Social Analytics plugin up to and including version 0.2 are affected. The plugin is available from the WordPress plugin repository and is reproduced by MartijnScheijbeler.

The CVSS score of 7.1 classifies the vulnerability as high severity, while the EPSS score of less than 1% indicates a very low current exploitation probability. The issue is not listed in the CISA KEV catalog. The attack vector most likely involves a malicious CSRF request that an attacker can trigger—for example, via a crafted link or by forcing a user’s browser to submit a form while authenticated. Once the malicious script is stored, every subsequent visitor who renders the affected content will execute the injected payload.