The vulnerability in the WordPress Admin Cleanup plugin allows an attacker to perform a cross‑site request forgery that injects a persistent script into the site’s content. Once stored, the script executes in the browsers of any user who views the affected content, potentially compromising account sessions, defacing the site, or delivering malicious payloads.

Users running the Matt Gibbs Admin Cleanup plugin version 1.0.2 or earlier are affected. No other products or versions are listed as impacted.

The CVSS score of 7.1 indicates a high severity, while an EPSS score of less than 1% shows a low likelihood of widespread exploitation at present. The issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to send a crafted request that triggers the CSRF in an authenticated admin session, making attackers who can lure an administrator to a malicious link capable of injecting the stored script.