The TabGarb Pro plugin for WordPress contains a Cross‑Site Request Forgery flaw that allows a malicious actor to embed a script that is persisted in plugin‑related content. When the forged request is submitted, the plugin stores the script and subsequently renders it whenever the content is viewed, causing the attacker’s code to execute in the browsers of site visitors. This vulnerability is classified as CWE-352 and can lead to session hijacking, defacement, or exfiltration of sensitive data.

All WordPress sites that use the webgarb TabGarb Pro plugin version 2.6 or earlier are susceptible. Any installation that has not upgraded past this version should be considered at risk.

The CVSS score of 7.1 indicates a high impact if the weakness is exploited. The EPSS score of less than 1% suggests that exploitation is unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog. The description does not explicitly state whether authentication is required; it is inferred that successful exploitation likely requires an authenticated administrator or privileged user, as is typical for CSRF attacks that perform state‑changing actions.