The ANAC XML Render WordPress plugin contains a Cross‑Site Request Forgery flaw that permits an attacker to embed malicious script into the plugin’s data storage. When an authenticated user submits a forged request, the script is stored in the WordPress database and later rendered on site pages, allowing the script to execute in the browsers of visitors who view those pages, thereby creating a stored cross‑site scripting vulnerability.

All releases of the EnzoCostantini55 ANAC XML Render plugin up to and including version 1.5.7 are affected. The vulnerability applies across all earlier, unspecified versions released under the same product line.

The CVSS score of 7.1 indicates a high severity flaw, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the short term. The flaw requires that a valid, logged‑in WordPress user execute the forged request, so it is not a purely public remote attack but hinges on authenticated access. The vulnerability is not listed in the CISA KEV catalog, so there is no confirmed exploitation for this issue.