The vulnerability is a Cross‑Site Request Forgery flaw in the GravatarLocalCache plugin. By forging a request, an authenticated user can modify stored content that the plugin saves, which may include arbitrary JavaScript. When other visitors display that stored content, the injected script is executed in their browsers. The CVE data does not specify cookie theft or defacement, but the stored script can run client‑side code.

WordPress sites running cybio GravatarLocalCache plugin version 1.1.2 or earlier are affected. All installations of the plugin within this range are susceptible.

The CVSS score of 7.1 indicates high severity. The EPSS score of <1% implies a low probability of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is a malicious link that causes the CSRF request from an authenticated user’s browser, resulting in the attacker’s script being stored and later executed for other site visitors.