Cross‑Site Request Forgery allows an attacker to inject malicious JavaScript that is stored in the WordPress database via the WP‑Easy Menu plugin. Once stored, the script runs in the browser context of any user who views the affected page, allowing attackers to hijack sessions, deface the site, or perform further phishing attacks. This stored XSS is the primary impact described in the CVE.

Jordi Salord’s WP‑Easy Menu plugin for WordPress is affected for all releases from the earliest available version up to and including 0.41. Any site running the plugin on or before version 0.41 is vulnerable.

The CVSS score of 7.1 indicates a high potential impact, while the EPSS score of <1 % suggests exploitation is unlikely but not impossible. The vulnerability can be triggered by crafting a forged request that an authenticated user submits via the plugin’s interface, after which the malicious content is stored and later rendered. The vulnerability is not listed in CISA’s KEV catalog, meaning no widespread exploitation has been reported. Administrators should assume the risk could be exploited in environments where the plugin is enabled and users have sufficient privileges.