The Custom Functions Plugin allows an attacker to send a crafted request that a logged‑in administrator will unknowingly execute. Because the plugin lacks proper CSRF protection, the malicious request stores a <script> payload in a post or settings field. Any visitor who later views the stored content will trigger the script in the victim’s browser, potentially stealing credentials, hijacking sessions, or performing further attacks. The weakness is a classic Cross‑Site Request Forgery leading to Stored Cross‑Site Scripting, classified as CWE‑352.

WordPress users running the Custom Functions Plugin by Shamim Hasan, version 1.1 or older. All releases up to and including 1.1 are vulnerable due to insufficient CSRF checks.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1 % suggests that exploitation is currently infrequent but remains possible. The vulnerability is not listed in the CISA KEV catalog, but the vector is likely a CSRF attack that requires the user to be authenticated. Once triggered, the stored XSS can affect any visitor to the site, leading to broad confidentiality and integrity risks.