The AdSense Privacy Policy plugin suffers from a Cross‑Site Request Forgery vulnerability that permits attackers to inject malicious scripts which are then persistently stored by the site. This stored XSS flaw can be used to steal site credentials, deface the website, or deliver malware to visitors, compromising confidentiality, integrity, and availability of the affected WordPress instance.

WordPress sites running the hotvanrod AdSense Privacy Policy plugin version 1.1.1 or earlier are impacted. The plugin appears in the vendor name hotvanrod, with the affected version range listed through <=1.1.1.

The CVSS vector gives a score of 7.1, indicating high severity. The EPSS score is reported as <1%, which suggests exploitation likelihood is currently low. The vulnerability is not listed in the CISA KEV catalog. The flaw is a CSRF that can be triggered by an attacker via a forged request from a legitimate user’s browser; the success path requires the victim to be logged in with sufficient privileges to modify plugin settings, after which the injected script is stored and executed for all site visitors. Based on the provided data, the risk is high severity but the current exploitation probability remains low.