Technical impact
The vulnerability is a Cross‑Site Request Forgery that leads to stored cross‑site scripting. A malicious actor can trick an authenticated WordPress user into performing an action that stores user‑controlled data in the IP2Location World Clock plugin. Once stored, the data is executed by other users browsing the affected pages, enabling session hijacking, cookie theft, or other client‑side attacks.
Affected Systems
The issue affects the IP2Location World Clock WordPress plugin, versions from the earliest releases up to and including 1.1.9. Any WordPress installation running this plugin is potentially vulnerable.
Risk and Exploitability
The CVSS base score of 7.1 indicates moderate to high severity. EPSS less than 1% suggests low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires an authenticated session with the capability to submit plugin data, so the likely attack vector is a logged‑in user who falls victim to a CSRF attack. The attacker does not need to exploit server‑side code directly; the impact manifests through client‑side script execution.
EUVD