Cross‑Site Request Forgery in the OffClicks Invisible Optin plugin allows an attacker to inject malicious script that is stored in the site and then executed for every visitor. The stored XSS can result in theft of user credentials, session hijacking, defacement, or other malicious actions performed in the context of legitimate users.

WordPress sites running the OffClicks Invisible Optin plugin version 1.0 or earlier are affected. The vulnerability is present in all variants of the plugin up through version 1.0 regardless of the WordPress core version.

The CVSS score of 7.1 indicates a high severity. The EPSS score is below 1 %, suggesting that opportunistic exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. The flaw is a CSRF‑to‑stored‑XSS vector, so an attacker would need to drive an authenticated user or an administrator to a crafted request that submits the malicious payload. Once stored, the payload runs with the privileges of any site visitor.