A Cross‑Site Request Forgery flaw in the Nimbata Call Tracking WordPress plugin permits an attacker to inject and store malicious JavaScript. The stored script runs whenever a affected page is loaded, enabling the attacker to hijack the victim’s session, deface content, or perform other XSS‑related attacks.

The vulnerability targets the Nimbata Call Tracking plugin for WordPress, affecting all installed versions through 1.7.4. All WordPress sites that have the plugin before this release are at risk.

The CVSS base score of 7.1 indicates moderate severity, yet the EPSS score of less than 1% points to a low current exploitation probability, and the weakness does not appear in CISA’s known exploited list. The CVE description does not explicitly state whether authentication is required; it is inferred that exploitation would need an authenticated or privileged user to send a forged request, so the likely attack vector involves credential compromise or social engineering. While the risk remains moderate, patch application is the most reliable mitigation.