A Cross‑Site Request Forgery flaw exists in the WP Permalink Translator plugin that permits an attacker to submit requests that the plugin processes as authenticated because it does not properly verify the authenticity of incoming requests. Based on the description, it is inferred that the attacker could trigger changes that result in stored cross‑site scripting code being injected into the site, which is then executed in the browsers of any visitor. The issue is encoded as CWE‑352, indicating that the plugin does not properly verify the authenticity of incoming requests.

All versions of the WP Permalink Translator plugin up to and including 1.7.6 are affected. The plugin is released by Hossin Asaadi and is commonly installed on WordPress sites. Any site using one of the vulnerable releases is potentially exposed until the plugin is updated or mitigated.

The vulnerability has a CVSS score of 7.1, showing it is moderate to high severity, while its EPSS score of less than 1% indicates a low likelihood of widespread exploitation at present. It is not listed in CISA's KEV catalog. However, because the flaw can be triggered via simple web requests and does not require advanced skills, there remains a realistic risk for targeted websites that remain on outdated plugin versions.