A Cross‑Site Request Forgery flaw in the WP Content Protection plugin enables an attacker to submit a forged request that stores arbitrary JavaScript code on the site. Because the plugin does not validate the request origin, the injected script is served to all visitors, resulting in stored cross‑site scripting. The weakness is identified as CWE‑352 (Cross‑Site Request Forgery).

All versions of the WP Content Protection plugin from the first release up to and including 1.3 installed on a WordPress site are vulnerable. Any site that uses this plugin, regardless of other plugins or themes, is at risk.

The CVSS score of 7.1 reflects a high impact severity. The EPSS score of less than 1% indicates that, as of now, the likelihood of public exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a forged request to a protected endpoint; while the CVE description does not explicitly state that the attacker needs authenticated privileges, it is inferred that the attacker must force a WordPress user who has editing rights to submit the malicious request. Once the script is stored, every visitor to the site receives it, potentially compromising site integrity and confidentiality.