The vulnerability allows an attacker to craft a request that a user’s browser will automatically submit, exploiting a Cross‑Site Request Forgery flaw. Because the request is processed by the WordPress Windows Live Writer plugin, the attacker can inject arbitrary JavaScript that is stored and executed whenever the affected content is viewed, leading to potential data theft or defacement.

The plugin is developed by dalziel under the name Windows Live Writer. Versions from the first release through 0.1 are affected; no higher versions received the fix.

The CVSS score of 7.1 indicates a moderate to high severity. The EPSS score is listed as less than 1%, suggesting that, at the time of this analysis, exploitation is expected to be rare. The vulnerability is not included in the CISA KEV catalog. The likely attack vector is a targeted CSRF attack where the victim is prompted to visit a malicious page while authenticated to the site, allowing the attacker to insert stored XSS content without further user action.