The alphasis Related Posts via Taxonomies plugin contains a Cross‑Site Request Forgery flaw that can be leveraged to store malicious script code. By submitting a crafted request, an attacker can inject JavaScript that will be rendered server‑side and delivered to every visitor. This stored XSS allows an attacker to execute arbitrary client‑side code whenever the affected page is viewed, which may lead to defacement or other malicious browser‑side effects. The weakness is classified as CWE‑352.

WordPress installations using the alphasis Related Posts via Taxonomies plugin version 1.0.1 or older are potentially affected. No other vendors or product variants are mentioned in the supplied data.

The CVSS base score of 7.1 indicates a high‑severity issue. The EPSS score is reported as less than 1 %, suggesting a low probability of active exploitation, yet the flaw remains exploitable. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the CSRF weakness by inducing any site user or attacker‑controlled request to submit the forged form, resulting in stored XSS. The impact is confined to the integrity of rendered content and the client‑side execution realm.