Cross‑Site Request Forgery in the shawfactor LH OGP Meta plugin enables an attacker to inject malicious scripts that are stored forever in the website’s metadata. When a user loads a page that includes the compromised metadata, the script executes in the browser, allowing the attacker to deface the site, hijack user sessions, or redirect traffic. The weakness is classified as CWE‑352, indicating that the system fails to protect against unauthorized state changes triggered by forged requests.

WordPress sites that use the shawfactor LH OGP Meta plugin version 1.73 or earlier are affected. Any installation that has the plugin installed and contains meta tag entries managed by that plugin is vulnerable. The plugin is typically used to add Open Graph tags for social media optimization, making it common across many WordPress sites.

The CVSS score of 7.1 signals a high risk of exploitation. The EPSS score of less than 1 % indicates that the vulnerability is rarely exploited at the time of assessment, and it is not listed in the CISA KEV catalog. Based on the definition, it is inferred that an attacker could craft an HTTP request that bypasses the CSRF check, which might be delivered via a malicious link or phishing message. Once the store‑time script is added, any visitor to the site will execute the injected code.