The vulnerability is a Cross‑Site Request Forgery that allows an attacker to store malicious JavaScript into the Simple Documentation plugin. An authenticated user who inadvertently submits a forged request will have the script injected and persisted, which will then execute whenever the documentation page is viewed. This yields Stored Cross‑Site Scripting. The underlying weakness is identified as CWE‑352, and the consequence can include session hijacking, defacement, or other malicious exploitation.

The susceptible product is the WordPress plugin Simple Documentation, developed by mathieuhays, in all releases up through version 1.2.8. Any WordPress site currently running this plugin, regardless of WordPress core version, is affected.

The CVSS score of 7.1 indicates moderate‑to‑high severity, while the EPSS score of < 1% reflects a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with editing rights; an attacker would need to lure that user into clicking a crafted link that submits the malicious payload. No additional technical prerequisites beyond such privileged access are described, but the impact could affect the entire site if malicious scripts are executed in visitors’ browsers.