The Ajax Comment Form CST plugin contains a CSRF flaw on the settings page, allowing an unauthenticated attacker to send a forged request that updates plugin settings with malicious JavaScript. The injected script is stored on the site and delivered to logged‑in users, enabling stored XSS attacks that can hijack sessions, deface content, or deliver malware. The vulnerability stems from missing or incorrect nonce validation, which is a classic input validation weakness (CWE‑79).

Vendors and products affected are WordPress sites using the rafe007 Ajax Comment Form CST plugin, versions 1.2 and earlier. No specific version numbers beyond the ≤1.2 limit are listed.

The CVSS score of 6.1 indicates moderate severity. An EPSS score of less than 1% suggests low likelihood of exploitation, and the vulnerability has not been listed in CISA’s KEV catalog. Attackers require only a link or image that an administrator will unknowingly click, making it a practical CSRF attack but limited to sites with the vulnerable plugin and an active admin user.