The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to perform stored Cross‑Site Scripting against the WordPress Global Meta Keyword & Description plugin. By manipulating a fault‑free request that an authenticated user submits, the attacker can embed malicious script that is saved in the plugin’s configuration. When other site visitors load content that pulls values from this plugin, the script executes in their browsers, potentially stealing session cookies, defacing pages, or redirecting users to phishing sites.

This issue affects WordPress installations running the Global Meta Keyword & Description plugin version 2.3 and earlier. The problem is present in all WordPress sites that have the plugin installed and have not applied a newer release.

The CVSS score is 7.1, indicating a moderate‑to‑high impact when the flaw is exercised. The EPSS value of <1% suggests a very low probability of exploitation under current conditions, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a web‑based CSRF attack that requires an authenticated user, typically an administrator, to submit a forged request. If the attacker can obtain or hijack an admin session, the stored XSS payload can be injected and then executed for all site visitors.