A Cross‑Site Request Forgery flaw in the PlainInventory WordPress plugin allows an attacker to submit a forged request that stores malicious script code in the system. The stored script is later executed in the browser context of any user who views the affected page.

The vulnerability is present in Plainware’s PlainInventory plugin for WordPress, affecting all releases up to and including version 3.1.9. Users and site administrators running these versions should verify their installation and consider upgrading to a patched release if available.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The flaw is not listed in the CISA KEV catalog. Attackers typically exploit the CSRF weakness by getting an authenticated user to visit a crafted URL or by embedding the request in a malicious site, after which the injected script can persist and affect all subsequent users who view the stored content.