The vulnerability is a Cross‑Site Request Forgery weakness that allows an attacker to insert malicious script content into the language‑field plugin’s storage. If an attacker succeeds, the stored JavaScript can execute in the browsers of visitors who view the affected content, potentially leading to credential theft, session hijacking or defacement. The flaw is rooted in improper validation of request tokens and is classified as CWE‑352.

WordPress sites running theode’s Language Field plugin, any version through 0.9 inclusive. The absence of version data for earlier releases indicates the issue persists up until the last listed version.

The CVSS score of 7.1 indicates a high severity aligned with the potential impact. However, the EPSS score of less than 1% suggests a low probability of active exploitation at this time, and the vulnerability is not yet catalogued in CISA’s KEV list. Likely attack vectors involve a logged‑in administrator or editor who unknowingly submits a crafted form that the plugin processes without adequate CSRF checks. The attacker does not need to bypass authentication but relies on the victim’s authenticated session to inject the payload.