The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to send a request lacking a CSRF token to the GeroNikolov Instant Breaking News plugin. Because the plugin stores content without proper validation, the attacker can insert malicious JavaScript into the database. When a site visitor loads a page that displays this stored content, the script runs in the visitor’s browser, potentially stealing session cookies or manipulating the page.

All WordPress installations that include the GeroNikolov Instant Breaking News plugin version 1.0 or earlier are affected. The vulnerability applies to every release of the plugin up to and including 1.0.

The CVSS score of 7.1 indicates a moderate‑to‑high severity asset. EPSS is below 1 % and the issue is not listed in the CISA KEV catalog, suggesting a low current exploitation probability. The attack is delivered through the web interface; the description does not specify an authentication requirement, so the flaw may be exploitable by anyone able to send a forged request to the plugin’s content endpoint. The risk is realistic for sites where the WordPress admin area or the plugin’s submission mechanism is exposed to unauthenticated users.