A Cross‑Site Request Forgery flaw in the WordPress Google News Editors Picks Feed Generator allows an attacker to craft a request that stores malicious JavaScript into the feed data. The injected code would then execute whenever a user views the affected feed, resulting in persistent XSS.

The vulnerability affects the PPDPurveyor Google News Editors Picks Feed Generator plugin for WordPress, with affected releases up to and including version 2.1. The plugin is installed on WordPress sites that have not been patched to a later version.

The CVSS score of 7.1 indicates a moderately high severity, while the EPSS score of less than 1% suggests a low likelihood of real‑world exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a CSRF request using a user who has permission to edit the feed, which the attacker can trigger by luring the target into visiting a malicious URL. The result is stored XSS that will affect all visitors to the feed.