A Cross‑Site Request Forgery flaw in the Call Now PHT Blog plugin can be leveraged to inject and permanently store malicious JavaScript. By sending a specially crafted request, an attacker can place a script into posts or other content types that will run whenever any site visitor views the affected content. Once stored, the script can hijack user sessions, exfiltrate data, or force browser redirections, compromising both confidentiality and integrity for all users.

The vulnerability affects the WordPress plugin Pham Thanh Call Now PHT Blog for all releases up through version 2.4.1. No higher versions were noted; therefore any installation using 2.4.1 or earlier is impacted.

The CVSS score of 7.1 denotes a Moderate to High severity. The EPSS score of < 1% indicates a low probability of active exploitation today, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is accessed via CSRF, an attacker needs to trick a legitimate user into sending a forged request; this typically occurs with a simple drive‑by link or embedded form. While technically straightforward, the requirement for a logged‑in victim and the low exploitation likelihood mean that the threat is moderate, yet the impact of a successful injection remains serious.