The banner-manager plugin for WordPress can be tricked into storing malicious JavaScript because it fails to validate a CSRF token. An attacker can submit a forged request that inserts user‑agent‑containing scripts into the banner configuration. Whenever a site visitor loads the banner, the injected code runs in the visitor’s browser, allowing the attacker to steal cookies, session tokens or perform other malicious actions on the victim’s behalf. The weakness is classified as CWE‑352 – Cross‑Site Request Forgery leading to stored cross‑site scripting.

The vulnerability affects the karrikas banner‑manager plugin for WordPress in all releases up to version 16.04.19 inclusive. Earlier or later releases are not known to be affected.

The CVSS score of 7.1 indicates a high level of severity, yet the EPSS score of less than 1% suggests that the probability of successful exploitation is currently very low. The flaw is not listed in the CISA KEV catalog, meaning no confirmed exploitable attacks have been reported. Exploitation requires an attacker to persuade the site owner or an authenticated administrator to trigger the CSRF request, or to place a malicious link or iframe that coerces a user into performing the request. Because the flaw resides in a widely used WordPress plugin, the potential impact is significant for any site that has the plugin active.