A Cross‑Site Request Forgery flaw in the WP Compare Tables plugin allows an unauthenticated or low‑privilege user to submit a request that bypasses normal security checks, resulting in the injection of malicious script into a data field that is subsequently displayed to other users. The stored payload can execute arbitrary JavaScript in the context of the site, enabling attackers to steal session cookies, deface content, or redirect users to phishing sites. This weakness corresponds to CWE‑352.

The vulnerability exists in the WP Compare Tables plugin developed by Martin, affecting all releases from the earliest available version through version 1.0.5 inclusive. Users who still run one of these versions are exposed.

The CVSS score of 7.1 indicates a high severity risk, but the EPSS score of less than 1% suggests that real‑world exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack surface is inferred to involve a forged authenticated request, as the flaw relies on CSRF to inject the payload.