A Cross‑Site Request Forgery flaw allows an attacker who tricks a logged‑in administrator to send a specially crafted request that stores malicious JavaScript in the plugin’s data. Because the stored code is rendered as part of the post listing, clicking a link or loading a page in the victim’s browser injects the attacker’s script, enabling session hijacking, defacement or other malicious actions. The weakness is identified as CWE‑352.

The vulnerability affects the WordPress plugin "List of Posts from each Category" by frucomerci. Versions from any unknown earlier release through version 2.0 are affected. Site owners running these plugin versions are exposed to the described CSRF‑to‑stored XSS vector.

The CVSS score of 7.1 indicates a high-impact vulnerability with automatic exploitation potential via CSRF. The EPSS score of < 1% shows a very low current likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to convince a logged‑in user to access a malicious link—a low-cost attack with no need for privileged access or direct interaction with the affected plugin beyond the normal user role.