The flaw allows a malicious actor to force an authenticated user to submit a crafted request to the AWcode Toolkit plugin, resulting in arbitrary script code being stored in the database. Once stored, the code executes in the browser context of any visitor to that content, enabling attackers to steal cookies, hijack sessions, or perform other malicious actions. The weakness is a Classic Cross‑Site Request Forgery that leads to Stored Cross‑Site Scripting, as identified by CWE-352.

WordPress sites running the AWcode Toolkit plugin up to and including version 1.0.18 are affected. Any attacker who can trick a logged‑in user into visiting a malicious page while the plugin is installed can exploit the vulnerability.

With a CVSS score of 7.1 the vulnerability is considered high severity, but the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The plugin is not listed in the CISA KEV catalog. The attack requires a victim to be authenticated and to follow a crafted link or embed a malicious request, so the vector is web‑based and depends on user interaction. Once executed, the stored script runs under the victim’s browser context and can compromise confidentiality and integrity of the site’s data.