A Cross‑Site Request Forgery flaw in the Related Posts Line‑up‑Exactly by Milliard plugin lets an attacker perform actions on behalf of an authenticated user and store malicious script code that later executes in the browsers of visitors to the site. The stored payload can compromise confidentiality, integrity, and availability by stealing credentials, modifying content, or directing users to phishing pages. The vulnerability is a classic example of CWE‑352, where missing verification of the origin of a request permits exploitation.

The risk applies to any WordPress site running the Related Posts Line‑up‑Exactly by Milliard plugin version 0.0.22 or earlier. The relevant product identifier is shisuh:Related Posts Line‑up‑Exactly by Milliard. Site owners should verify the installed version and ensure it is no longer within the vulnerable range.

The CVSS score of 7.1 indicates a high severity, but the EPSS score of less than 1% suggests that, as of the latest data, the probability of exploitation by attackers is low. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is a crafted web request made from an external site that forces the victim’s browser to submit a form to the plugin’s endpoint without verifying a CSRF token, thereby embedding the attacker’s script into the site content.