A CSRF vulnerability in the WordPress Stock Message plugin allows an attacker to trick a victim into submitting a crafted request that stores malicious JavaScript payloads in the plugin’s data. This stored XSS can later be executed in the context of victims’ browsers, potentially leading to session hijacking, defacement, or credential theft. The weakness originates from inadequate request validation, resulting in CWE-352. The vulnerability is essentially a CSRF flaw that escalates to client‑side code execution.

This issue affects the Stock Message plugin developed by Aftabul Islam. All releases up to and including version 1.1.0 are vulnerable; no fixed version is listed within the CVE data.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation attempts are currently rare but not impossible. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires a user with sufficient privileges to submit a request to the plugin’s endpoint, but the CSRF nature means an attacker can coerce a legitimate user’s browser to perform this action. If successful, the stored XSS can run in any visitor’s browser that views the infected content.