A CSRF attack enables an attacker to store malicious JavaScript in the WordPress site, resulting in stored XSS that could execute in the context of users visiting affected pages. The vulnerability stems from the RSS Digest plugin not validating input or including a CSRF protection mechanism and is identified as CWE‑352. Stored XSS can compromise confidentiality by exfiltrating data, alter the integrity of web pages, and disrupt user experience.

The flaw affects the RSS Digest plugin for WordPress developed by samcharrington, versions from the earliest available build up to and including 1.5. Any WordPress installation utilizing this plugin within that version range is vulnerable.

The CVSS score of 7.1 indicates high severity, yet the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a forged HTTP request from a malicious site that causes the plugin to store a payload, which is then served to end users. Consequently, while the potential impact is significant for sites relying on the plugin, the practical risk is moderated by the low probability of exploitation and the lack of public exploitation evidence.