A Cross‑Site Request Forgery (CSRF) flaw in the Blackbam TinyMCE Advanced qTranslate fix editor problems plugin allows an attacker to force an authenticated user to submit a crafted request that stores malicious JavaScript in the WordPress editor. The stored payload is then executed in the browser context of any user who views the affected content, enabling session hijacking, data theft, or defacement. This weakness is categorized as CWE‑352.

The vulnerability affects the TinyMCE Advanced qTranslate fix editor problems plugin from its initial release up through version 1.0.0. All installations of Blackbam’s plugin within that range are susceptible, regardless of the WordPress version they run on.

The CVSS score of 7.1 indicates a moderate to high severity, while an EPSS score of less than 1% suggests a low probability of exploitation in the wild at this time. The exploit requires a target with permissions to edit content and the ability for the attacker to influence the CSRF request—an attacker could embed the request in a malicious page or email. Because the vulnerability leads to stored XSS, the potential impact includes compromising user sessions, leaking confidential data, and defacing sites. The plugin is not currently listed in the CISA KEV catalog, but the severity warrants proactive remediation.