The Insert Code plugin for WordPress contains a Cross‑Site Request Forgery vulnerability that permits an attacker to inject persistent JavaScript code into the site. When an authenticated user performs a request that is not properly verified, the malicious script is stored and executed on future page loads, causing Stored XSS. This makes an attacker able to steal session cookies, deface content, or conduct further attacks against site users.

The issue affects BCS Website Solutions Insert Code versions up to and including 2.4 when installed on WordPress sites. Any deployment using a plugin version <= 2.4 is vulnerable, regardless of WordPress core version.

The CVSS score of 7.1 indicates a high severity, but the EPSS score of less than 1% indicates a low likelihood of active exploitation. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires a user with sufficient privileges to submit code and a suitable CSRF attack vector, so an attacker would typically lure an administrator or editor into executing a crafted request. Based on the description, it is inferred that the attacker would target administrators to submit arbitrary code, making the impact high while the probability remains low.