This vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to inject malicious script content into comments that is then stored on the site. The resulting Stored XSS can execute in the browsers of visitors, potentially hijacking sessions, defacing the site, or leaking sensitive information. The weakness is identified as CWE‑352, indicating that the application fails to verify the legitimacy of user‑initiated requests.

WordPress sites that have the Austin Comment Validation Reloaded plugin installed in any version up to and including 0.5 are affected. No other products or versions are listed as impacted.

The CVSS score of 7.1 places the flaw in the "High" severity range, meaning a successful exploitation can lead to widespread impact. The EPSS score is below 1%, signifying a very low but non‑zero probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a crafted HTTP request that bypasses the plugin’s comment validation through CSRF, allowing the attacker to submit malicious comments that are stored and displayed to all site visitors.