WordPress re.place plugin has a CSRF flaw that allows an attacker to inject malicious scripts which are stored on the site. The vulnerability can lead to persistent cross‑site scripting, potentially enabling session hijacking, defacement or bypassing of the site’s security controls. The weakness is classified as CWE‑352, indicating a lack of proper request validation.

Affected systems include WordPress installations that have the re.place plugin version 0.2.1 or earlier. The plugin is distributed by the vendor dor:re.place. No specific minor sub‑versions are listed beyond the upper bound of 0.2.1.

The CVSS score of 7.1 reflects a fairly high severity, while the EPSS score of less than 1 % indicates a low probability of exploitation at the moment. The vulnerability is not currently listed in CISA’s KEV catalog. Attackers could exploit the flaw by sending a forged request to a privileged user or by having a victim click a crafted link. An attacker would need to target a WordPress site running the vulnerable plugin and persuade a logged‑in user to visit the malicious URL.