The MaxA/B plugin for WordPress contains a Cross‑Site Request Forgery flaw that allows an attacker to inject persistent malicious scripts into the site’s content. By forging a request that a legitimate administrator or authorized user submits, the adversary can store arbitrary JavaScript, leading to defacement, credential theft, or session hijacking for any subsequent visitor. The weakness is classified as CWE‑352.

The vulnerability affects the MaxA/B plugin from maxfoundry, in all versions up to and including 2.2.2. No patch or fixed version is explicitly listed in the advisory; administrators should verify current plugin versions against the vendor’s release notes.

The CVSS base score of 7.1 indicates a high severity. The EPSS score of less than 1 % suggests that the probability of exploitation is currently low, and the vulnerability is not recorded in the CISA KEV catalog. Successful exploitation would still require a user to execute a crafted CSRF request, which typically entails a social‑engineering component or a compromised user session. Once triggered, the stored XSS script runs with the affected site’s privileges, enabling widespread impact.