Cross‑Site Request Forgery (CSRF) in the WordPress Hotspots Analytics plugin allows attackers to inject malicious scripts that are stored in the site's database. The stored Cross‑Site Scripting (XSS) can then be served to any visitor of the site, enabling execution of arbitrary JavaScript in the user’s browser. This weakness is identified as CWE‑352, a generic CSRF flaw.

WordPress sites that use the dpowney Hotspots Analytics plugin version 4.0.12 or earlier. The vulnerability applies to all installations of the plugin from its earliest version up through 4.0.12.

The CVSS score of 7.1 indicates a medium‑to‑high risk severity, while the EPSS score of under 1 % indicates a low probability of exploitation at the time of reporting. The vulnerability is not listed in CISA KEV. Attackers must convince a logged‑in administrator or another privileged user of the site to submit a forged request. Based on the CSRF nature of the flaw, it is inferred that an attacker could construct a request that causes a script to be stored and later delivered to site visitors.