The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to store malicious script content in a WordPress site. By tricking an authenticated user into submitting a crafted request, the attacker can embed JavaScript that is later executed in the context of the site, resulting in persistent client‑side code injection. This Stored XSS can lead to credential theft, defacement, or execution of arbitrary actions by the victim’s browser.

The issue affects all installations of the Advanced lazy load plugin for WordPress, version 1.6.0 and earlier. The plugin is developed by kasonzhao and is available as the "advanced‑lazy‑load" add‑on for WordPress sites.

With a CVSS score of 7.1 the vulnerability is considered high severity. The EPSS score of less than 1 % indicates a low probability of exploitation, and the flaw is not listed in CISA’s KEV catalog. Attackers would need to gain the ability to perform a CSRF request against a user with sufficient privileges to submit stored content. The impact is largely confined to the integrity of the site’s front‑end content, but the stored XSS payload could also be used to hijack user sessions or perform phishing attacks against site visitors.