A Cross‑Site Request Forgery flaw in the WP‑Planification WordPress plugin allows an attacker to store malicious script code in user‑generated content. When an authenticated user later views this stored data, the injected script executes in the user’s browser, leading to potential session hijacking, data exfiltration, or interface manipulation. The weakness is identified as CWE‑352, reflecting improper protection against CSRF‑derived state changes that enable stored XSS.

The vulnerability affects the WP‑Planification plugin by Mathieu Chartier, all releases from the earliest available version up to and including2.3.1. The plugin is commonly used within WordPress sites for event and calendar management, and any site running one of these affected versions is in scope.

This flaw earned a CVSS score of 7.1, indicating a medium‑to‑high severity impact. The EPSS score shows less than 1 % likelihood of exploitation, so the risk is comparatively low, and it is not listed in the CISA KEV catalog. The exploit path requires an attacker to trick an authenticated user into executing a crafted request—typically via a malicious link or forged email—leveraging the CSRF vulnerability to inject content that later triggers stored XSS during normal plugin usage.