The vulnerability allows an attacker to forge a request that a site visitor submits, causing malicious script to be stored through the WP Odoo Form Integrator plugin and executed in the browser of any user who views the affected content. This results in the compromise of confidentiality and integrity of the affected site, as the injected script could steal credentials, log keystrokes, or launch further attacks. The weakness is identified as a Cross‑Site Request Forgery that leads to stored XSS.

WordPress sites running the coderscom WP Odoo Form Integrator plugin version 1.1.0 or earlier are impacted. No other vendors or product versions are currently listed as affected.

The CVSS score of 7.1 reflects a high severity assessment, while an EPSS score of <1% indicates a low probability of exploitation in the current threat landscape. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted request to a site user, which could be delivered via a phishing link or embedded in a malicious web page, exploiting the absence of proper CSRF tokens to inject and store arbitrary JavaScript.