This vulnerability is a cross‑site request forgery that allows attackers to inject and store malicious JavaScript code into the WordPress Grid plugin. The weakness is identified as CWE‑352. By exploiting it an attacker could have the stored script executed in the browsers of site visitors, potentially leading to session hijacking, data theft, or defacement. The impact is limited to the scope of the victim’s browser session and the data accessible to the user of the site.

The affected product is the WordPress Grid plugin developed by EdwardBock, version 2.3.1 and any earlier release. Users running this plugin on any WordPress installation are vulnerable.

The CVSS score of 7.1 indicates a high severity. The EPSS score of less than 1% shows a very low likelihood of exploitation at the time of reporting, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web request to the plugin’s endpoint, requiring an authenticated or privileged user to trigger the CSRF request. An attacker must persuade a legitimate user to visit a malicious page that submits the forged request or supply a crafted request themselves. No public exploit code is known, but the weakness could be used as part of a broader attack chain.