The InLocation plugin for WordPress contains a Cross‑Site Request Forgery flaw that allows an attacker to inject malicious scripts into the database. The injected script is then delivered to any user who views the affected page, causing arbitrary script execution in the victim’s browser.

WordPress sites that have the InLocation plugin by Gabrieldarezzo installed are affected. All releases from the initial version through 1.8 include the vulnerability.

The CVSS score of 7.1 signifies a high‑severity vulnerability, yet the EPSS score of <1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the CVE description, which identifies a CSRF flaw that permits stored XSS, it is inferred that exploitation requires the attacker to forge a request that bypasses the plugin’s CSRF protections, typically by compromising or spoofing an authenticated session. Once the forged request injects malicious code, it is stored and subsequently served to all site visitors.