Cross‑Site Request Forgery in the wpNamedUsers plugin allows attackers to craft a request that is automatically executed by a logged‑in user, resulting in stored cross‑site scripting. The vulnerability can be used to inject malicious scripts into the site’s database, which are later served to every visitor. This can compromise user sessions, deface content, and exfiltrate sensitive data.

The issue affects WordPress sites that use the wpNamedUsers plugin from andriassundskard version n/a through 0.5. Any installation of this plugin on a WordPress site that has not yet been updated is vulnerable.

The CVSS score of 7.1 indicates a high severity, but the EPSS score of less than 1% suggests that exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires a valid session and a crafted request sent to the site, it is most likely to be leveraged by attackers with access to user credentials or by social engineering. Once executed, stored XSS can lead to credential theft and site compromise.