The vulnerability is a CSRF flaw in the WP Attractive Donations System plugin, allowing an attacker to forge authenticated requests on behalf of a logged-in user and potentially inject malicious content that may persist as stored XSS. This weakness can lead to unauthorized changes, data manipulation, and content compromise on the affected WordPress site.

Loopus' WP Attractive Donations System plugin versions prior to 1.29, specifically all releases from the initial release (n/a) through < 1.29, are affected. WordPress sites installing these plugin versions are vulnerable.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of <1% suggests a low current exploit probability. The vulnerability is not listed in CISA KEV, implying no confirmed widespread exploitation yet. Based on the description, the likely attack vector is a malicious link or form that forces a victim’s browser to submit privileged requests to the site, exploiting the missing anti-CSRF token. Successful exploitation could lead to unauthorized administrative actions or permanent content injection.