The vulnerability allows an attacker to perform a Cross‑Site Request Forgery attack that results in stored malicious JavaScript code being inserted into the Custom Posts Order plugin settings. Once stored, the script executes in the browsers of any user who views the affected content, enabling theft of session data, defacement, or further attacks. The weakness is a classic CSRF flaw that leads to persistent XSS.

WordPress sites that use the Custom Posts Order plugin by Hiren Patel, version 4.4 or older. All installations with a user role that can alter the plugin settings are potentially exposed.

The CVSS score of 7.1 indicates a moderate severity, while the EPSS of <1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a logged‑in user with permission to modify plugin configuration; an attacker can craft a malicious request that tricks the user into submitting it, after which the injected script will run in subsequent visits by other users. No public exploit details are disclosed, but the attack path is clear from the description.