The vulnerability in the NewsMAN NewsmanApp WordPress plugin allows an attacker to perform a cross‑site request forgery that leads to stored cross‑site scripting. An adversary can entice a legitimate user to submit a crafted request that stores malicious script in the plugin’s data store; once stored, the script executes in any visitor’s browser, potentially exposing session cookies or defacing content. This flaw is classified as CWE‑352 and poses a high confidentiality and integrity risk to site administrators and their users.

The affected product is the NewsMAN NewsmanApp plugin for WordPress, versions from the first release up to and including 2.7.7. All deployments using these or earlier releases remain vulnerable until updated.

The CVSS score of 7.1 denotes high severity, while the EPSS score of <1% indicates that large‑scale exploitation has not been reported. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it remotely by influencing a valid user’s browser to send a malicious request, requiring no privileged access. The malicious payloads are stored persistently, making mitigation essential.