The YANewsflash WordPress plugin is vulnerable in all releases up to 1.0.3 because the yanewsflash.php handler does not validate the nonce correctly or at all. This oversight allows an unauthenticated actor to forge a request that the site administrator is tricked into submitting, updating plugin settings and injecting arbitrary scripts into the stored configuration. The injected scripts are then served to anyone who visits the site, creating a stored cross‑site scripting condition that can be leveraged for defacement, credential theft or drive‑by downloads.

The affected product is the YANewsflash plugin from vendor stratosg. All releases with version numbers 1.0.3 or earlier are vulnerable. Administrators using any WordPress installation that has this plugin installed and enabled should verify the current version and update if necessary.

The CVSS base score of 6.1 indicates moderate severity, and the EPSS score of less than 1 % points to a very low probability of exploitation at the time of this analysis. The vulnerability is not yet listed in the CISA KEV catalog. The attack requires the target administrator to click a malicious link or submit a forged form, so an attacker can only gain effect after luring a privileged user to perform an action. Although the likelihood is low, an active attacker could still trigger the stored XSS for any site visitor, potentially compromising user sessions and enabling further attacks.