A Cross‑Site Request Forgery flaw in the BetPress WordPress plugin allows an attacker to inject a malicious script into the site’s content store, resulting in persistent cross‑site scripting. This flaw is a CWE‑352 vulnerability, enabling the attacker to bypass normal user permissions. The attacker can then exploit any user who views the compromised content to execute arbitrary code, steal session information, or perform further attacks against the host.

The vulnerability affects the BetPress plugin for WordPress from its earliest release until version 1.0.1 Lite. Any WordPress installation using BetPress 1.0.1 Lite or earlier is potentially exposed, regardless of the WordPress core version or other plugins.

The CVSS score of 7.1 indicates a fairly high impact if exploited. The EPSS score of less than 1 % shows that exploitation is currently unlikely, and the issue is not listed in the CISA KEV catalog, suggesting no known active exploits. Based on the description, the attack vector is inferred to be via CSRF: a malicious user or website can craft a request that forces the victim to submit a forged form that stores a malicious script. Successful exploitation would depend on the victim visiting the transposed link and interacting with the site, making user interaction a prerequisite.