The vulnerability is a Cross‑Site Request Forgery flaw that allows attackers to submit forged requests to the Simple Archive Generator plugin, resulting in stored XSS. An attacker can embed malicious JavaScript that is persisted within the archive output and will execute for any user who later accesses that archive. The weakness is classified as CWE‑352, indicating improper protection against CSRF, which can lead to arbitrary script execution.

The affected product is the WordPress plugin Simple Archive Generator from the vendor peterwsterling. Versions up to and including 5.2 are impacted; versions beyond 5.2 are not affected.

The CVSS score of 7.1 indicates high risk, but the EPSS score of less than 1% shows a low estimated likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a victim who is logged in with privileges to create archives and to be reached by a crafted link or page that forces the forgeable request. The CSRF nature suggests the attack vector is an unauthenticated or impersonated user visiting a malicious URL while authenticated to the target site.