The KBucket plugin for WordPress allows an attacker to perform a Cross‑Site Request Forgery (CSRF) attack. By convincing an authenticated administrator to visit a crafted URL, the attacker can inject arbitrary JavaScript that is then stored in the site’s database. When the compromised content is later rendered in the browser, the malicious script executes with the privileges of the site visitor, potentially leading to session hijacking, defacement, or the execution of further malicious code. This stored XSS flaw is defined as CWE‑352.

The vulnerability exists in the Optimal Access KBucket plugin (WordPress) for all versions up to and including 4.1.6. Any WordPress site running a vulnerable version of this plugin is susceptible.

The vulnerability carries a CVSS score of 7.1, indicating a high severity level. The EPSS score is less than 1%, suggesting that the likelihood of exploitation in the wild is currently low. It is not listed in the CISA KEV catalog. Attackers would need access to an authenticated admin session or the ability to trick an admin into visiting the forged request, a condition that is relatively easy to achieve in social engineering or compromised accounts scenarios. Once the payload is stored, any visitor who loads the affected content will be exposed to the malicious JavaScript.