A CSRF flaw in the Simple Auto Tag plugin allows an attacker to inject a malicious script into stored data, resulting in stored XSS when the data is displayed on the site. The vulnerability is classified as CWE‑352 based on the provided description. No details are given about what input triggers the flaw or what context the stored data is rendered, so the exact scope of impact remains unspecified beyond the potential for arbitrary script execution on front‑end pages.

The Simple Auto Tag plugin by djjmz, enabled on WordPress installations, is impacted for all releases up to and including version 1.1.

The CVSS score of 7.1 indicates high severity. The EPSS score of less than 1% suggests a low likelihood of active exploitation at this time, and the CVE is not listed in CISA’s KEV catalog. Exploitation would involve a CSRF attack that submits forged data to the plugin; based on standard CSRF behavior, a logged‑in user would need to be tricked into visiting a specialized link. However, the CVE description does not explicitly state authentication requirements or the request details, so these conditions are inferred from typical CSRF patterns rather than confirmed.