The VikRestaurants WordPress plugin contains a Cross‑Site Request Forgery flaw that allows an attacker to submit a crafted request that stores malicious JavaScript. When the stored data is later displayed to a browser, the injected script runs with the privileges of the visiting user, potentially enabling session hijacking, defacement, or other malicious actions.

All WordPress sites running e4jvikwp VikRestaurants plugin version 1.3.3 or earlier are exposed to this flaw.

The vulnerability carries a CVSS score of 7.1, indicating a high severity level. The EPSS score is below 1 %, suggesting that, as of now, the likelihood of exploitation is low, and the CVE is not listed in the CISA KEV catalog. Because the flaw is a CSRF vector, the attacker must trick a privileged user—typically an administrator—to trigger a request that stores the malicious input. The attack can be executed by embedding a link or form on a third‑party site that the target visits while signed in. No public patch version is currently available, so the risk remains until the plugin is updated.