A Cross‑Site Request Forgery flaw exists in the WordPress Create Posts & Terms plugin versions up to 1.3.1. This weakness allows an attacker to trigger the plugin’s state‑changing actions without user interaction, resulting in stored cross‑site scripting content being saved to the site. The vulnerability is associated with CWE‑352 and can compromise the confidentiality and integrity of the site’s content if exploited.

The issue affects WordPress installations running the Create Posts & Terms plugin from its initial release through version 1.3.1, as supplied by developer Valentin Agachi.

The CVSS score of 7.1 signals a high severity, while the EPSS score of less than 1% indicates that, at the time of this analysis, the attack likelihood is currently low. The vulnerability is not listed in the CISA KEV catalog. An attacker would need a logged‑in user with privileges on the WordPress site to exploit it, likely by tricking the target into visiting a malicious page that sends a crafted request to the vulnerable plugin endpoint. Once triggered, the plugin would store attacker‑supplied payloads as post or term content.