This vulnerability allows an attacker to trigger a CSRF request that results in reflected XSS, enabling malicious script injection into pages viewed by unsuspecting users, potentially compromising credentials or stealing session data.

The affected system is the Secret Meta plugin by WPDeveloper, used within WordPress installations, with all versions up to and including 1.2.1.

The vulnerability carries a CVSS score of 7.1 and an EPSS score of less than 1 %, indicating rare exploitation prospects. Although it is not listed in the CISA KEV catalog, the fact that it is a CSRF‑to‑XSS flaw means an attacker can simply craft a malicious link to bypass the CSRF protection and inject arbitrary scripts into the user's browser session. The lack of an exploit listing suggests the risk is moderate, but the high severity warrants swift remediation.