Cross‑Site Request Forgery in Iqonic Design’s WPBookit plugin allows an attacker to embed malicious scripts that are stored by the plugin, creating a stored Cross‑Site Scripting vector. Because the flaw is triggered by forged requests, a malicious website could cause a user’s browser to submit data that injects persistent code into the application. If the injected script runs on subsequent visits, it could execute in the context of any authenticated user, potentially enabling session hijacking, defacement, or data exfiltration. The likely attack vector is inferred from the description to involve forged HTTP requests that submit malicious payloads. The weakness is identified as CWE‑352.

The vulnerability affects the Iqonic Design WPBookit plugin for WordPress, specifically all releases from the first build through version 1.0.1. Users running WPBookit 1.0.1 or earlier are impacted.

The CVSS score of 7.1 indicates a high severity, and the EPSS score of less than 1 % suggests that exploitation is currently unlikely but not impossible. The flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers can exploit the vulnerability by sending forged HTTP requests to the plugin’s endpoints from a malicious site, causing a victim’s browser to unknowingly submit the request and store malicious code. Once the payload is installed, any user who accesses the compromised content can be affected, making the attack highly potent if the attacker can persuade users to visit the site.