The CVE identifies a CSRF flaw in the mg12 WP‑EasyArchives WordPress plugin that permits a malicious actor to construct a forged request. When an authenticated user submits the request, malicious code can be stored in the site’s content, creating a stored cross‑site scripting condition that will be executed for every visitor who loads the affected page. This weakness aligns with CWE‑352.

The plugin WP‑EasyArchives, version 3.1.2 and all preceding versions, is affected. Any WordPress installation running mg12 WP‑EasyArchives 3.1.2 or earlier is at risk. The vendor identifier is mg12.

The CVSS base score of 7.1 reflects a high severity vulnerability. The EPSS score of less than 1% indicates a very low likelihood of exploitation recorded at the time of analysis, and the issue is not listed in the CISA KEV catalog. The threat hinges on an attacker identifying a logged‑in administrator or privileged user and delivering a CSRF payload that stores malicious script; because the vulnerability is stored, it persists until the plugin is upgraded or the request vector is blocked.