This vulnerability is a Cross‑Site Request Forgery that permits an authenticated user to submit requests on behalf of the attacker. The attacker can inject malicious input that may be stored by the plugin and later executed in other users’ browsers, which could lead to theft of session cookies, defacement, or data exfiltration. The weakness is classified as CWE‑352.

The plugin is WordPress Custom Widget Classes by Jamsheer K. Versions 1.1 and older are affected. The vulnerability is present in all installations of these versions on any WordPress site that hosts the plugin.

The CVSS score of 7.1 indicates a high potential for damage. The EPSS score of less than 1% suggests a low probability of exploitation at the moment and the vulnerability is not currently listed in the CISA KEV catalog. The most likely attack vector is a CSRF attack performed by a malicious web page that tricks a logged‑in WordPress user into visiting a crafted URL. Because the flaw allows stored payloads, an attacker could achieve persistent cross‑site scripting against other site visitors. The vulnerability requires that the victim be authenticated to the site but does not need privileges beyond a standard user account.