The vulnerability is a Cross‑Site Request Forgery flaw that allows malicious actors to execute Stored Cross‑Site Scripting code in the WordPress CJ Custom Content plugin. By forging a legitimate request, an attacker can inject arbitrary JavaScript that is permanently stored in the plugin’s content database. This payload can then run in the browsers of any user who views the affected content, compromising confidentiality, integrity, and potentially allowing further lateral movement.

The issue impacts the CJ Custom Content plugin developed by shibulijack, affecting every installed instance from unspecified earlier versions through version 2.0. WordPress sites running this plugin version are susceptible, with no version after 2.0 mentioned.

The CVSS score of 7.1 indicates a high severity potential for exploitation. The EPSS score of less than 1% suggests that the likelihood of an attack is low at present, and the flaw is not listed in the CISA KEV catalog. However, because the vulnerability is triggered via Cross‑Site Request Forgery, a user with sufficient privileges or a session that an attacker can hijack would be able to submit a crafted request. Once the XSS payload is stored, it will affect all users of the affected WordPress site.