The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to inject malicious JavaScript that is stored within the Supertext Translation and Proofreading plugin. Once stored, the script runs in the browsers of any user who views the affected content, providing an attacker the ability to steal session cookies, deface the site, or redirect visitors. This flaw is tied to CWE‑352 and offers a compromise of confidentiality and integrity but is not a remote code execution flaw.

The issue affects WordPress plugins from the vendor Supertext, specifically the Supertext Translation and Proofreading (polylang-supertext) plugin, through version 4.26. Any site running a vulnerable version is susceptible; newer releases are not mentioned as affected.

The CVSS score of 7.1 places this problem in the high severity range, yet the EPSS score is reported as <1%, indicating that exploitation attempts are currently very rare. The vulnerability is not listed in the CISA KEV catalog. The likely attack path would involve an attacker tricking a user with the appropriate privileges into submitting a malicious request that the plugin will store. Since no direct exploitation condition beyond CSRF is disclosed, the existence of robust authentication and CSRF protection will influence the real‑world risk.