The vulnerability is a stored cross‑site scripting flaw triggered by a cross‑site request forgery in the Edamam SEO, Nutrition and Print for Recipes plugin. An attacker can submit a forged request that causes the plugin to permanently store malicious JavaScript. When other users load the affected content, the script runs in their browsers, enabling session hijacking, credential theft or site defacement. The flaw is a duplicate of CWE‑352, compromising confidentiality, integrity and availability of the site.

All installations of the Edamam SEO, Nutrition and Print for Recipes plugin by Edamam up to and including version 3.3. This includes WordPress sites that have not upgraded beyond that version.

The CVSS score of 7.1 indicates high severity. The EPSS score of less than 1 percent suggests a low probability of exploitation in the near term, and the issue is not listed in CISA KEV. The attack vector is cross‑site request forgery, meaning an attacker can trick a legitimate user’s browser into sending the forged request, which then creates a stored XSS payload visible to all site visitors.