This vulnerability is a Cross‑Site Request Forgery that allows an attacker to store malicious JavaScript code in the price‑calc plugin’s data. When the stored data is rendered later, the script executes in the victim’s browser, enabling persistent XSS attacks such as defacement, cookie theft or unauthorized actions on behalf of the user. The flaw does not directly compromise the server but undermines user confidentiality, integrity, and possibly availability of the front‑end content.

The flaw affects the WordPress price‑calc plugin developed by jazzigor. All versions up to 0.6.3, inclusive, are vulnerable; earlier or later releases are not impacted. WordPress sites running these plugin versions are at risk.

The CVSS score of 7.1 indicates a high severity. The EPSS score of less than 1 % suggests that exploitation likelihood is low. The vulnerability is not listed in the CISA KEV catalog, so no current active exploit reports exist. Attackers can deliver the payload via a forged request, requiring a victim to unknowingly visit a crafted link or page that submits the malicious data. The stored XSS can persist until the data is removed or the plugin is upgraded.