The vulnerability is a Cross‑Site Request Forgery that permits a malicious payload to be stored through the Full Circle plugin. An attacker who can submit a crafted request will have that payload saved by the plugin, and future visitors to the site will receive the stored code as part of the page, creating a stored cross‑site scripting (XSS) condition. The description indicates only stored XSS; no other impact claims should be made.

Affected systems are any WordPress installation that includes the Full Circle plugin by James Andrews. All versions of the plugin from the earliest release up to and including 0.5.7.8 are vulnerable.

The CVSS score of 7.1 signals high severity. The EPSS score below 1 % indicates only a very low probability of exploitation at present, and the vulnerability is not in the CISA KEV catalog. Because the flaw is a CSRF, the likely attack path requires the attacker to be able to act as a privileged user or trick an authenticated user into submitting a malicious request; these prerequisites are inferred from the CSRF nature of the flaw.