A Cross‑Site Request Forgery flaw in the ivobrett Apply with LinkedIn buttons plugin allows an attacker to inject malicious script that is stored by the application. Once the script is saved, any user who views the affected data will execute the attacker’s code in their browser.

The vulnerability impacts WordPress sites running the Apply with LinkedIn buttons plugin from its initial release up through version 2.3. The affected product is the plugin itself, created by ivobrett.

The CVSS score of 7.1 indicates high potential for damage, but the EPSS score of less than 1 % suggests a low likelihood of exploitation at present, and the flaw is not catalogued in CISA’s KEV database. Based on the description, it is inferred that exploitation would require an attacker to successfully submit a forged request that stores a malicious payload; thereafter, any site visitor who loads the stored data would execute the injected script.