A CSRF flaw in the Simasicher SimaCookie WordPress plugin permits an attacker to submit a crafted request that the plugin accepts and stores as configuration content. The stored command becomes part of the site’s output and is executed by browsers when pages are loaded, resulting in stored cross‑site scripting. The weakness is a classic CSRF scenario (CWE‑352).

All WordPress installations that have the Simasicher SimaCookie plugin at version 1.3.2 or earlier are affected; the issue resides within the plugin, not the WordPress core, so sites without the plugin are not vulnerable.

The CVSS score of 6.5 classifies the flaw as moderate. The EPSS score of less than 1 % indicates a low published exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is an external HTTP request that bypasses the plugin’s lack of CSRF protection; exploitation typically requires the victim to be authenticated or to load the page where the stored script is rendered, so administrators or content‑management users face the highest risk.