The vulnerability is a Cross‑Site Request Forgery that permits an attacker to store malicious JavaScript through the SEO For Images plugin. Once the script is stored it executes on subsequent page views, exposing site visitors to arbitrary client‑side actions such as credential theft or defacement. The flaw is a classic stored XSS, allowing persistent exploitation across user sessions.

WordPress installations running the SEO For Images plugin version 1.0.0 or earlier, developed by kasonzhao.

The CVSS score of 7.1 indicates high severity. The EPSS score is below 1 %, implying a very low, but non‑zero, probability of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the flaw by forging a request to the plugin from an authenticated administrator or by tricking a user into visiting a crafted link, after which a malicious payload is stored and later delivered to all site visitors. The attack vector is inferred to use legitimate user privileges as a source of the CSRF request.