The plugin contains a CSRF flaw that allows malicious actors to store harmful JavaScript in the website’s footer. Attackers exploit the flaw by sending a crafted request that bypasses authentication checks, leading to persistent cross‑site scripting that runs when visitors load the footnote. The impact is that any user views the affected page can have their session data, cookies, or tracked interactions compromised through injected code.

The vulnerability affects the WordPress plugin "Copyright Safeguard Footer Notice" by wygk, version 3.0 and earlier. Sites that have installed this plugin up to and including version 3.0 are at risk.

The vulnerability has a CVSS base score of 7.1, which indicates a high potential for damage if exploited. The EPSS score is below 1%, suggesting that the likelihood of real‑world attacks is currently low, and it is not in the CISA KEV list. The official advisories do not list any known exploits, implying limited attacker activity. Based on the description, it is inferred that the CSRF may require an authenticated session to effect the stored XSS; if true, attackers who compromise administrative credentials could inject malicious code that runs for all site visitors.