The vulnerability is a cross‑site request forgery flaw that allows an attacker to cause the WordPress plugin to reflect attacker‑controlled data in a response, resulting in reflected cross‑site scripting. An exploited victim would have arbitrary JavaScript executed in their browser, enabling session hijacking, data theft, or defacement. The weakness is identified as CWE‑352.

WordPress users running the Simple Post Meta Manager plugin by Sandor Kovacs, versions up to and including 1.0.9, are affected. No other products or versions are listed as vulnerable.

The CVSS score of 7.1 indicates a medium‑to‑high severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to lure a user to a crafted URL or page that triggers the CSRF request, which then causes the vulnerable plugin to render the reflected script. Although the exploitation path requires user interaction, the impact on the victim’s browser is significant.