This issue allows an attacker to perform a Cross‑Site Request Forgery against a site running the Custom Script Integration plugin up to version 2.1. By exploiting the lack of CSRF protection the attacker can submit requests that inject arbitrary script code into the site’s storage. The stored scripts can then be executed in the browsers of all users who view the affected content, leading to data theft, defacement, or session hijacking. The vulnerability is classified as CWE‑352.

The plugin Custom Script Integration from vendor wpwox is affected in all releases from the initial version through version 2.1 inclusive. Users of any hosting environment where this plugin is installed and active are at risk.

The CVSS score of 7.1 indicates a high severity vulnerability with a medium to high impact. The EPSS score of less than 1% suggests that, while the risk is high, the likelihood of exploitation is currently very low. The vulnerability is not listed in the CISA KEV catalog. The attack vector typically requires a user with permission to submit content via the plugin; attackers can craft a malicious link or form that triggers the CSRF and injects the script.