The vulnerability allows an attacker to craft a forged request that exploits a cross‑site request forgery flaw, leading to the injection of malicious JavaScript that is stored within the WordPress site. Once the script is stored it will execute whenever a page containing the compromised content is viewed by any user. The weakness is identified as CWE‑352, a classic CSRF defect capable of producing persistent XSS. The description does not provide details beyond that the stored script can execute, so the exact downstream effects are limited to what a typical XSS payload could achieve.

Black and White:BookPress – For Book Authors plugin for WordPress is affected for all releases up to and including version 1.2.7. Versions beyond 1.2.7 are not listed as vulnerable and are presumably not affected.

The CVSS score of 7.1 indicates moderate to high severity. The EPSS score of less than 1% suggests that the probability of exploitation is very low at present, and the vulnerability is not disclosed in the CISA KEV catalog. The likely attack vector requires a forged request, and it is inferred that an authenticated user with sufficient privileges would need to initiate the attack, but the exact requirements are not detailed in the advisory.