The vulnerability is a Cross‑Site Request Forgery that enables an attacker to inject malicious JavaScript into stored comments made through the Quote Comments plugin. By forging a request that a victim authorises, the attacker can embed a script that will execute when any user views the comment, leading to session hijacking, data theft, or defacement. The flaw is directly related to CWE‑352, which identifies the lack of proper CSRF protection and the resulting stored XSS effect.

The defect affects the Quote Comments plugin for WordPress authored by Stanko Metodiev. Versions from the earliest release through 3.0.0 are vulnerable, with 3.0.1 and later addressing the issue.

The CVSS base score of 7.1 places this as a high‑severity item, while the EPSS score of less than 1% indicates that exploitation is currently uncommon but non‑negligible. The vulnerability is not listed in CISA’s KEV catalog. Likely users must be authenticated to post a comment, suggesting that the attack vector involves a logged‑in administrative or content‑editor user being tricked or compromised to submit a forged request. The attacker can then place malicious payloads that persist across sessions and affect any visitor who views the compromised content.