A Cross‑Site Request Forgery (CWE‑352) vulnerability exists in the WordPress Oganro XML Travel Portal Widget plugin versions up to and including 2.0. The flaw allows an attacker to trick an authenticated user into submitting malicious requests to the plugin, potentially performing state‑changing actions such as modifying widget configuration or affecting booking data. The impact concerns the integrity and availability of the booking functionality; confidentiality is not directly affected.

The vulnerability affects WordPress sites that have the Oganro XML Travel Portal Widget plugin installed with version 2.0 or earlier. The affected vendor is Oganro, product XML Travel Portal Widget. No other vendors or versions are affected according to the CNA data.

The CVSS score of 4.3 denotes moderate severity, while the EPSS score below 1% indicates a low likelihood of exploitation in the near term. The CISA KEV catalog does not list this vulnerability. Exploitation would likely require a victim to be logged into the WordPress site and to follow a crafted link or form; the exact attack vector is inferred from typical CSRF patterns.