The vulnerability in Esselink.nu Settings is a CSRF flaw that also permits reflected XSS, enabling an attacker to coerce a legitimate user into submitting requests that execute unintended actions or inject malicious scripts; the weakness is identified as CWE‑352, indicating a failure to adequately check the origin of state‑changing requests

Any WordPress site running Esselink.nu Settings version 4.5 or earlier is susceptible; the vulnerability applies from the earliest version available through version 4.5

The CVSS score is 7.1, reflecting a high potential for exploitation, but the EPSS score of less than 0.01% suggests low likelihood of widespread attack; the vulnerability is not listed in CISA KEV, indicating no known large‑scale exploitation, and the attack vector is likely a crafted HTTP request requiring the victim to click a link or visit a malicious page