The Simple Responsive Menu plugin contains a Cross‑Site Request Forgery flaw that permits an attacker to insert arbitrary script code into the menu data. When a forged request is sent, the plugin writes the malicious payload into stored configuration, which later is rendered without proper sanitization. This stored XSS can be executed in the browser of any user visiting the affected site, potentially allowing the attacker to steal session cookies, deface the site, or defraud users.

The vulnerability affects the WordPress plugin Simple Responsive Menu by Pukhraj Suthar, versions from the first release through version 2.1 inclusive. Any site running these editions is susceptible; no specific WordPress core or other plugins are mentioned.

The CVSS score of 7.1 indicates a high severity. The EPSS score of < 1% suggests that the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, relying on an attacker inducing a victim to visit a crafted URL or form that performs the CSRF action against a logged‑in site administrator or user.