The vulnerability is a Cross‑Site Request Forgery that permits an attacker to store malicious JavaScript content in the RSS Manager plugin’s data. Because the plugin stores user‑provided data without proper sanitization, the injected script can be executed when the stored content is rendered by a browser. This vulnerability is identified as CWE‑352. Based on the description, it is inferred that the attacker must be able to craft a CSRF request that targets a user with sufficient privileges to modify the plugin’s settings.

Any WordPress installation running the RSS Manager plugin by vendor ajayver, with versions up to and including 0.06, is vulnerable. No other product versions are affected according to the CVE data.

The CVSS score of 7.1 indicates a medium‑to‑high severity. The EPSS rating of less than 1% suggests a low probability of current exploitation, and the vulnerability is not listed in CISA KEV. Exploitation would require a logged‑in user with permissions to modify the plugin’s settings, making the attack path dependent on administrative access. Based on the description, it is inferred that the attacker would need to obtain or coerce such user credentials to submit a proper CSRF request. Once a proper CSRF request is submitted, the stored payload is inserted and will execute when the content is rendered by a browser.