This flaw results from the Navayan Subscribe plugin lacking CSRF protection. An attacker can submit malicious input that the plugin stores without validation, causing a persistent XSS payload that runs in the browsers of anyone who views the affected content. The stored script can steal user credentials, deface the site, or deliver malware, compromising both data integrity and user confidentiality.

All releases of the Navayan Subscribe plugin, developed by Amol Nirmala Waman, from the initial version through 1.13 are impacted because none include the missing CSRF check.

The CVSS score of 7.1 indicates high severity, yet the EPSS score of less than 1% shows that exploitation is currently uncommon. The flaw is not listed in CISA KEV. Based on the description, the likely attack vector is an attacker crafting a forged HTTP request from a malicious site to trigger the Navayan Subscribe action, causing the plugin to store malicious script that will be served to any visitor. Such stored XSS can steal credentials, deliver malware, or deface the site, compromising user confidentiality and data integrity.