The Rankchecker.io Integration plugin for WordPress contains a Cross‑Site Request Forgery flaw (CWE‑352) that permits an attacker to forge requests that store malicious scripts in the site’s content. When these stored scripts are later viewed, they execute in users’ browsers, compromising confidentiality, integrity, and availability of the affected WordPress site.

WordPress installations running Rankchecker.io Integration version 1.0.9 or earlier are impacted. The plugin is provided by Rankchecker and is available through the official WordPress plugin repository.

The CVSS score of 7.1 indicates high impact, yet the EPSS score of less than 1% suggests that real‑world exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation generally requires the attacker to craft a CSRF request against the plugin’s stored‑script endpoint, often necessitating a legitimate user session or the ability to embed malicious content through an authenticated user’s action. Despite the low exploitation probability, the high severity warrants prompt remediation.