The vulnerability is a cross‑site request forgery in the Naren Members Page Only for Logged In Users plugin that allows an attacker to inject malicious script that is stored and later executed when a page is rendered. The stored XSS can compromise the confidentiality and integrity of user sessions and the entire site, potentially allowing code execution in the context of the logged‑in user. The weakness is identified as CWE‑352.

This issue affects the Members Page Only for Logged In Users plugin for WordPress versions from the initial release through 1.4.2. Any installation running a version equal to or older than 1.4.2 is vulnerable. No specific WordPress core version requirement is listed, so the vulnerability applies broadly to all WordPress sites hosting the plugin in this version range.

The CVSS score of 7.1 indicates a medium‑to‑high severity. The EPSS score under 1% shows that the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog, reducing the urgency somewhat. The likely attack vector requires a logged‑in user to be tricked into visiting a crafted URL that triggers the CSRF and stores malicious payload. An attacker with a valid authenticated session can thereby inject persistent XSS, which may then be leveraged for credential theft or further code execution.