The Virtual Moderator plugin for WordPress contains a Cross‑Site Request Forgery weakness that, when in use, can be abused to perform Cross‑Site Scripting attacks. An attacker can craft a malicious request that causes the plugin to execute arbitrary JavaScript in the context of a logged‑in WordPress user, potentially exfiltrating data, hijacking sessions, or defacing the site. The flaw falls under CWE‑352 and can compromise confidentiality, integrity, and availability of the affected website.

WordPress sites that install the Virtual Moderator plugin version 1.4 or earlier, released by Adnan Haque (a11n). All installations of the plugin from its earliest release through 1.4 are vulnerable.

With a CVSS base score of 7.1, the vulnerability poses a moderate‑to‑high risk. The EPSS score is listed as <1%, indicating a low probability of exploitation at present, and it is not yet catalogued in CISA KEV. Likely attack vectors involve an attacker hosting a malicious page that forces a logged‑in administrator to load the vulnerable URL, thereby triggering the CSRF‑to‑XSS chain.