The vulnerability is a CSRF flaw found in the Twitch TV Embed Suite plugin up to version 2.1.0. It allows an authenticated user to trigger a request that stores malicious JavaScript payloads in the WordPress database. When that content is later displayed, the injected script executes in the browser, giving the attacker the ability to steal session cookies, deface pages, or perform other typical stored XSS attacks.

All WordPress sites that have the Twitch TV Embed Suite plugin from plumwd installed with a version number less than or equal to 2.1.0 are affected. The issue is present in every release prior to 2.1.1, as indicated by the vulnerability’s version range.

The CVSS score of 7.1 classifies the flaw as high severity, but the EPSS score of less than 1 % suggests a low likelihood of exploitation. The vulnerability has not appeared in CISA’s KEV catalog. An attacker would need to send a crafted link to a logged‑in user or otherwise induce that user to make the vulnerable request. Once the stored XSS payload is executed, the attacker can hijack sessions or exfiltrate sensitive data. No public exploits have been reported, but the combination of a CSRF trigger and persistent XSS grants significant impact if successfully exploited.