The vulnerability is a Cross‑Site Request Forgery flaw in the LinkedInclude WordPress plugin that permits an attacker to inject malicious script that is stored on the site. This leads to Stored Cross‑Site Scripting, allowing an attacker to deface content or steal cookies and other session data from users interacting with the compromised site. The weakness is classified as CWE‑352.

All installations of ERA404 LinkedInclude versions from the beginning of the plugin’s history through version 3.0.4 are affected. The exact minimum version is not specified, but any release up to and including 3.0.4 is vulnerable.

The CVSS score of 7.1 indicates a high severity. The EPSS score is less than 1 %, suggesting that while the risk is significant, exploitation may be uncommon. The plugin is not listed in the CISA KEV catalog. Exploitation requires an attacker to trick a user into sending a crafted request, typically by embedding a malicious link or form in a third‑party site. Once triggered, the stored script runs with the privileges of any user visiting the affected page.