The AlT Monitoring plugin for WordPress fails to validate nonces on the admin edit page, enabling an unauthenticated attacker to forge a request that updates the settings. Once the admin is tricked into submitting the forged request, malicious scripts can be injected into the plugin settings and subsequently executed in the browsers of any visitor to the site, leading to stored cross‑site scripting. The vulnerability itself is a classic CSRF condition exploiting missing or incorrect protection on a state‑changing endpoint.

WordPress sites that have installed AlT Monitoring version 1.0.3 or earlier. The plugin is distributed by the vendor alti5 and is installed as a standard WordPress plugin.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests the probability of active exploitation is low at the moment. The vulnerability is not listed in CISA KEV, and because an attacker can inject scripts that execute in visitors' browsers, the primary threat is stored cross‑site scripting. The path of exploitation requires user interaction – the target admin must click a link or button that contains the forged request – which, once executed, can lead to potential confidentiality and integrity impacts (inferred) because injected scripts could exfiltrate data or alter displayed content.