A cross‑site request forgery flaw in the WordPress "Redirect wordpress to welcome or landing page" plugin allows an attacker to trick an authenticated administrator into sending a request that stores malicious JavaScript. Once stored, the script runs in the browsers of any site visitor, enabling session hijacking, defacement, or data theft.

The vulnerability affects sites running the Eslam Mahmoud "Redirect wordpress to welcome or landing page" plugin through version 2.0. Users of WordPress who have the plugin installed and are running an affected version are at risk.

The CVSS score of 7.1 indicates a high severity, but the EPSS score of less than 1% suggests a low probability of exploitation at this time. The flaw is not listed in CISA KEV. An attacker would need to exploit the CSRF token weakness while an administrator performs a privileged action, making the attack vector limited to users with administrative rights. If successful, the stored XSS could lead to widespread compromise of visitor sessions and site integrity.