The vulnerability is a Cross‐Site Request Forgery flaw that allows an attacker to inject malicious JavaScript that is stored within the WordPress site. The stored XSS can execute when the site is viewed by anyone, potentially leading to session hijacking, defacement, or collection of confidential data. The CVE description does not specify that authentication is required to exploit the issue.

The WordPress plugin Replace Default Words, developed by mandegarweb, in all releases from the initial version through version 1.3 is affected. No newer versions have been confirmed to contain the flaw.

With a CVSS score of 7.1 the vulnerability is considered high severity. The EPSS score of less than 1% indicates a low likelihood of widespread exploitation at this time, and the issue is not listed in the CISA KEV catalog. The attack vector is likely achieved through a CSRF request, though the CVE description does not specify whether authentication is required.