A CSRF flaw in the Billy Bryant Tabs plugin for WordPress permits an attacker to store an arbitrary script in the website’s content. The stored script executes in the browsers of any authenticated user who views the affected page, allowing data theft, session hijacking, or defacement. The weakness is identified as CWE‑352 and leads directly to a Stored XSS condition.

The vulnerability affects the Tabs plugin by Billy Bryant in all releases up to and including version 4.0.3. Any WordPress site that has this plugin installed, regardless of the overall WordPress version, is at risk.

The CVSS score of 7.1 indicates a medium‑to‑high severity. The EPSS score of less than 1% shows a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to create a CSRF request, which can be done by embedding a malicious link in an email or blog post. An authenticated or co‑authenticated user clicking that link would trigger the victim to submit the crafted request, causing the plugin to store the XSS payload that later runs when other users load the page. Because the vulnerability uses a CSRF vector, social engineering or phishing is typically required to deliver the request.