The vulnerability is a Cross‑Site Request Forgery that permits an attacker to inject malicious scripts, resulting in stored cross‑site scripting. The flaw allows request forging because the Block Country plugin lacks CSRF protection, enabling an attacker to submit a crafted request that stores user‑supplied content in the database, which will then be rendered on any page that displays the block. The resulting stored XSS can steal user credentials, inject malware, or deface the site.

Affected systems are WordPress installations that include the nitinmaurya12 Block Country plugin version 1.0 or earlier. The plugin is available from WordPress.org and is commonly used to restrict content by country. No other vendors or product versions are listed.

The CVSS score of 7.1 indicates a high impact potential. The EPSS score of less than 1% shows a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely network‑based and relies on a logged‑in user performing a forged request; an attacker does not need elevated host privileges but requires an authenticated session to make the request, after which the stored script can execute in any visitor's browser.