A CSRF flaw in the Genki Announcement plugin for WordPress lets an attacker force a logged‑in administrator to submit a crafted request that stores a malicious script in announcement content. That script then runs whenever any user views the announcement, enabling data theft, session hijacking, defacement, or traffic redirection. The vulnerability combines a cross‑site request forgery weakness (CWE‑352) with a persistent XSS capability.

The flaw affects the Genki Announcement plugin by genkisan on all releases up to and including version 1.4.1.

The CVSS score of 7.1 classifies the issue as high severity, and the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by crafting a CSRF request that forces an authenticated user to submit content containing malicious code, thereby injecting a persistent script. Successful exploitation could compromise site integrity and user trust.