A Cross‑Site Request Forgery vulnerability exists in the WordPress root Cookie plugin that allows a malicious actor to store arbitrary JavaScript code in the site’s content. Because the stored payload is rendered for other users, an attacker can perform session hijacking, data theft, or further site compromise. The weakness is identified as CWE-352 and directly enables a stored cross‑site scripting attack.

WordPress plugin "root Cookie" by linickx. All released versions up through 1.6 are vulnerable. No newer versions are listed as affected, so any installation of version 1.6 or earlier is at risk.

The vulnerability has a CVSS score of 7.1, indicating high severity. EPSS is less than 1%, showing a very low but nonzero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely use a CSRF attack vector, requiring a logged‑in user to trigger the vulnerable action, after which the stored script would be executed in the victim’s browser.