A Cross‑Site Request Forgery vulnerability in the WP jQuery Persian Datepicker plugin allows an attacker to submit a crafted request that stores malicious JavaScript. When a user loads a page that retrieves the stored configuration, the malicious script executes with the site’s privileges, enabling the attacker to capture data or modify the page content. The weakness is identified as CWE‑352, indicating request validation is missing before data persistence.

The flaw affects the WordPress plugin WP jQuery Persian Datepicker distributed by bhzad. All releases through version 0.1.0 are impacted; no fix has been released for earlier versions. WordPress sites that have the plugin installed and have not upgraded are vulnerable.

The CVSS base score of 7.1 places the flaw in the high severity range. An EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a forged request that stores malicious code; the attack vector likely involves a logged‑in user or administrator submitting the request, after which any site visitor may load the stored payload. The analysis infers that authentication may be required due to the nature of WordPress plugin settings, but this requirement is not explicitly stated in the CVE description.