The vulnerability is a Cross‑Site Request Forgery that allows an attacker to store arbitrary code in the plugin's custom fields. Once stored, the code executes in the browser context of any user who views the affected category, enabling session hijacking, data theft, or defacement. This weakness is classified as CWE‑352 and can lead to significant confidentiality, integrity, and availability impacts.

WordPress sites that have installed alicornea Category Custom Fields plugin version 1.0 or earlier are affected. No additional version details are available beyond the stated maximum of 1.0.

The CVSS score of 7.1 highlights a high severity, yet the EPSS score of less than 1% indicates that such attacks are currently rare. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through an authenticated admin session; an attacker would pre‑populate a malicious request that the user, while logged in, would unintentionally submit, triggering the stored XSS.