An attacker can exploit a CSRF flaw in the Konami Easter Egg plugin to inject persistent malicious scripts into a WordPress site. The vulnerability permits the attacker to submit crafted form data that is stored and later rendered to all visitors, resulting in a stored cross‑site scripting condition. The flaw stems from insufficient protection against unauthorized state‑changing requests, allowing script payloads to be persisted without user confirmation.

The vulnerable plugin is Adrian Hanft’s Konami Easter Egg for WordPress, affecting all releases up to and including version 0.4. Any WordPress installation that has this plugin installed in one of those versions is exposed. No other products or vendors are listed in the advisory.

With a CVSS score of 7.1 the vulnerability is considered high‑medium severity. The EPSS of less than 1% indicates that exploitation is unlikely to be widespread yet, and the flaw is not included in the CISA KEV catalog, suggesting no documented active attacks. Attackers would likely use a crafted web page or social‑engineering tactics to force an authenticated user’s browser to send the forged request, then rely on the stored XSS to compromise visitors’ browsers.