The vulnerability is a CSRF flaw (CWE‑352) that permits an attacker to submit malicious input to the My Marginalia plugin, which is then stored and served to website visitors as JavaScript. This stored XSS can run arbitrary code in the context of the site, enabling defacement, cookie theft, or other client‑side compromises.

WordPress sites that have my‑marginalia plugin version 1.0.6 or earlier by the vendor davidfcarr. No specific minor versions are listed beyond the stated maximum.

The CVSS base score of 7.1 indicates a high severity, while the EPSS of less than 1% suggests that current exploitation attempts are rare. The link to KEV confirms it is not a widely observed exploit. Attackers require a CSRF vector, likely by tricking an authenticated administrator or site visitor into opening a crafted link. With the plugin's lack of input validation and no access controls, a single crafted request can inject the malicious payload.