The occupancyplan plugin for WordPress contains a Cross‑Site Request Forgery flaw that leads to stored Cross‑Site Scripting. A logged‑in administrator or other privileged user can be tricked into visiting a crafted link or submitting a form that causes the plugin to store malicious content. When that content is later displayed to visitors, the payload executes in their browsers, enabling session hijacking, defacement, or data exfiltration. The weakness is identified as CWE‑352. The stored nature of the XSS means the attack can persist until the malicious data is removed.

Any WordPress site that has the occupancyplan plugin version 1.0.3.0 or earlier installed is affected. The flaw exists in all plugin releases up to and including 1.0.3.0, regardless of the underlying theme or other plugins.

The CVSS score of 7.1 indicates moderate‑to‑high severity. The EPSS score of less than 1% shows that exploitation at this time is uncommon, yet the vulnerability is publicly documented. The likely attack vector is a malicious link or form that forces a logged‑in user to submit a request, which the plugin saves as part of the site’s content. Based on the description, it is inferred that user interaction is required for exploitation. Because the vulnerability is not listed in CISA’s KEV catalog, there are currently no master indicators of compromise for it.