The vulnerability is a Cross‑Site Request Forgery that permits a malicious actor to inject and store arbitrary JavaScript in the plugin. When the forged request is processed, the injected script executes in the context of the victim’s browser, resulting in Stored Cross‑Site Scripting. This can lead to session hijacking, defacement, or execution of arbitrary code in the victim’s browser.

WordPress installations that have the Time Based Greeting plugin from Yash Binani installed at versions 2.2.2 or earlier are affected. No lower bound is listed, but any installation running at or before 2.2.2 is susceptible.

The CVSS score of 7.1 indicates medium‑high severity. The EPSS score of less than 1% shows a low probability of exploitation, and the vulnerability is not listed in CISA KEV. The likely attack vector involves an attacker crafting a malicious web page that causes an authenticated user to submit a forged request to the plugin’s endpoint, exploiting the missing CSRF protection and causing the stored XSS payload to execute in that user’s browser.