The Custom Smilies WordPress plugin includes a Cross‑Site Request Forgery flaw that allows a malicious actor to submit a forged request that the plugin accepts without proper protection. The payload contains JavaScript that is stored in a content field; when any site visitor loads the content, the script executes in the visitor’s browser, allowing the attacker to execute arbitrary code with the visitor's privileges.

WordPress installations that run the quanganhdo Custom Smilies plugin version 1.2 or older are affected. No earlier minor releases are listed, so the vulnerability applies exclusively to the identified version range.

The CVSS score of 7.1 places the issue in the High severity range, reflecting a serious combination of inappropriate request validation and persistent script injection. The EPSS score of < 1% indicates that, at the time of assessment, the likelihood of exploitation in the wild is very low, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be a CSRF scenario: an attacker tricks a user or an authenticated administrator into submitting a crafted request that contains the malicious script, which the plugin stores and later renders unescaped in public pages.