The Sweet Energy Efficiency plugin for WordPress contains a CSRF weakness that allows an attacker to inject arbitrary scripts that are stored in the site’s database, resulting in persistent cross‑site scripting. This flaw enables the attacker to trick authenticated administrators into submitting requests that execute malicious JavaScript on subsequent page views, potentially compromising user data and site integrity.

The vulnerability affects the Sweet Energy Efficiency plugin by WPDirectoryKit, versions up to and including 1.0.8. Any installation of the plugin within this version range is vulnerable.

The flaw is rated a CVSS score of 7.1 and has an EPSS score of less than 1 %, indicating a low current exploitation probability, and it is not listed in CISA KEV. The likely attack vector is a CSRF request sent by an attacker to a victim with administrative privileges, exploiting the lack of anti‑CSRF tokens to store malicious script code that then runs on future page loads. The risk is moderate‑high for sites that rely on the plugin and have remote administrators.