The Rentsyst plugin for WordPress contains a Cross‑Site Request Forgery entry point that allows an attacker who is able to forge a request on behalf of an authenticated user to inject a script that is stored in the website. When other logged‑in users request the affected page, the malicious script executes in their browsers, enabling the attacker to steal session cookies, deface content, or perform further actions. This stored XSS flaw can increase the impact to customers’ confidentiality and integrity.

WordPress plugin 'Rentsyst' by dimafreund. The vulnerability exists in all releases up to and including version 2.0.92. Versions beyond 2.0.92 are not affected.

The patch is rated with a CVSS score of 7.1, indicating high severity, while the EPSS score is under 1%, implying a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack requires an authenticated user to submit a forged request, and the stored script then runs in the victim’s browser when subsequent pages are loaded. The impact is high if successful, but the likelihood is considered low due to the EPSS score.