The vulnerability is a Cross‑Site Request Forgery that leads to stored cross‑site scripting. A malicious actor can trick an authenticated WordPress user into performing an action that stores user‑controlled data in the IP2Location World Clock plugin. Once stored, the data is executed by other users browsing the affected pages, enabling session hijacking, cookie theft, or other client‑side attacks.

The issue affects the IP2Location World Clock WordPress plugin, versions from the earliest releases up to and including 1.1.9. Any WordPress installation running this plugin is potentially vulnerable.

The CVSS base score of 7.1 indicates moderate to high severity. EPSS less than 1% suggests low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires an authenticated session with the capability to submit plugin data, so the likely attack vector is a logged‑in user who falls victim to a CSRF attack. The attacker does not need to exploit server‑side code directly; the impact manifests through client‑side script execution.