The vulnerability is a Cross‑Site Request Forgery flaw that lets an attacker store malicious script code in the WordPres 同步微博 plugin. Once injected, the script is persisted and executed in the browsers of any visitor to the site, potentially allowing theft of session cookies, defacing, or further compromise of the site. The flaw stems from inadequate token validation when processing user‑supplied data, which results in stored XSS that can affect confidentiality, integrity, and availability if the attacker gains administrative privileges.

The affected product is the iiiryan WordPres 同步微博 (wp2wb) WordPress plugin, versions through 1.1.0 inclusive. No other vendors or product versions are listed, and the vendor’s asset name is the plugin itself.

The CVSS score of 7.1 indicates a medium‑to‑high severity. The EPSS value of less than 1% suggests that exploitation is unlikely in the near term, and the vulnerability is not currently enumerated in CISA KEV. Exploitation requires sending a CSRF request that is processed while a legitimate user is authenticated, so a logged‑in admin session is typically necessary for the attack to succeed. If such a session occurs, the malicious payload will be stored and delivered to all site visitors.