The Audio Comments Plugin for WordPress is vulnerable to Cross‑Site Request Forgery in all versions up to 1.0.4. Missing or incorrect nonce validation on the settings page allows an unauthenticated attacker to perform a forged request that updates plugin settings and injects malicious web scripts. The injected scripts are stored and executed in the context of the site, potentially compromising confidentiality, integrity, or availability for visitors who view the page.

Vendors: naicuoctavian. Product: Audio Comments Plugin. All releases version 1.0.4 and earlier are affected; the vulnerability is present in every build up to and including 1.0.4.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of < 1% shows a low but nonzero likelihood of exploitation in the near term. The vulnerability is not currently listed in CISA KEV. Exploitation requires an attacker to trick a site administrator into accessing the settings page, most likely by enticing them to click a crafted link or form. Once the forged request succeeds, the attacker can store arbitrary script payloads that will run on subsequent page loads, enabling defacement, credential theft, or further malware distribution.