The vulnerability is a Cross‑Site Request Forgery flaw that permits an attacker to insert malicious script into stored content. Once the script is stored, it executes with the privileges of any user who views the affected content, leading to potential theft of credentials, session hijacking, or other malicious activity. This flaw is the classic result of missing or inadequate CSRF tokens as identified by CWE‑352.

The flaw affects the WordPress Bluff Post plugin published by hideoguchi, specifically all releases up through version 1.1.1. Users running any of these versions are potentially vulnerable until an update is applied.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation with current public knowledge. The flaw is not listed in the CISA KEV catalog, but an attacker with the ability to craft CSRF requests—such as via a malicious webpage or email link—could exercise the weakness if a victim visits the site while authenticated. Based on the description, it is inferred that the likely attack vector is remote, exploiting browsers' trust in the victim’s authenticated session, and could result in persistent XSS that follows the victim across the site.