The vulnerability is a Cross‑Site Request Forgery flaw that permits an attacker to submit crafted requests on behalf of an authenticated user, resulting in malicious scripts being written into the Sidebar Manager Light plugin’s storage. Once stored, the script is served to visitors, leading to persisted cross‑site scripting that can compromise confidentiality, integrity, or availability of the website. This weakness is a form of CWE‑352, which highlights the missing or inadequate CSRF protection.

WordPress users running OTWthemes Sidebar Manager Light from any unreleased version up to and including 1.18 are affected; all versions in this range lack the necessary CSRF guard and therefore store attacker‑controlled data in the plugin’s database.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% points to a very low likelihood of exploitation in the wild. Because the vulnerability requires an authenticated session and a valid CSRF context, an attacker would need to obtain or trick a legitimate user into executing the malicious request. The vulnerability is not listed in CISA KEV, further reducing its exploitation priority for most operators.