The yContributors WordPress plugin has a CSRF flaw that allows an unauthenticated attacker to submit forged requests to the plugin’s settings page. Because the page lacks proper nonce validation, the attacker can modify configuration values and inject arbitrary JavaScript that is persisted in the database. When any site visitor loads the affected page, the malicious script runs, giving the attacker the ability to deface content, hijack user sessions, or exfiltrate data. The weakness is an example of CWE‑352, a Cross‑Site Request Forgery that leads to Stored Cross‑Site Scripting.

The vulnerability affects the “yContributors” plugin authored by yonisink, any WordPress installation that has version 0.5 or earlier of the plugin installed. No specific sub‑versions are listed beyond the 0.5 cutoff. Administrators running those old releases are at risk.

The CVSS score of 6.1 indicates moderate severity. The EPSS score is below 1%, suggesting that exploitation is currently rare and likely requires a targeted attack where an administrator is tricked into clicking a malicious link. The vulnerability is not listed in CISA’s KEV catalog. An attacker would load a crafted URL or button on an external site that, when a logged‑in administrator visits, sends the forged request to the WordPress admin interface. Successful exploitation results in a stored XSS payload being delivered to end users.