The CallPhone'r plugin contains a Cross‑Site Request Forgery vulnerability that permits attackers to store malicious JavaScript payloads as page content, leading to Stored Cross‑Site Scripting. An attacker can inject a script that will then be executed whenever affected site visitors view the compromised content, potentially compromising user credentials, session tokens, or delivering malware. The issue is identified as CWE‑352, reflecting the underlying CSRF weakness that enables the payload injection.

WPShop.ru:CallPhone'r plugin, all releases through version 1.1.1. WordPress sites that have installed or use this plugin are vulnerable unless the plugin is upgraded or removed.

The CVSS score of 7.1 indicates a high severity impact, yet the EPSS score is less than 1%, suggesting a low but non‑zero likelihood of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a CSRF request from an authenticated user (most likely an administrator) who unknowingly submits a request that embeds the malicious script. Because the flaw requires an authenticated session, the potential for exploitation is limited to environments where attackers can trick privileged users into sending crafted requests.