The plugin contains a CSRF weakness that allows an attacker to inject malicious script data into stored content, leading to Stored Cross‑Site Scripting. By forcing an authenticated user to send a crafted request, an attacker can cause the script to be executed whenever the affected content is viewed. The description does not detail additional impacts beyond the injection of script.

WordPress sites with PressPage Entertainment Inc’s Mavis HTTPS to HTTP Redirection plugin at version 1.4.3 or earlier are affected. A lower bound for affected releases is not specified in the available data.

The CVSS score of 7.1 classifies the flaw as high risk, indicating significant potential impact if exploited. The EPSS score of <1% suggests that real‑world exploitation attempts are uncommon. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector, which is inferred from the CSRF nature of the flaw, involves an attacker tricking an authenticated user into submitting a crafted request—such as via a malicious link or form—so that the script is stored in the site’s content.