The ValvePress WordPress Automatic Plugin fails to validate nonces on a key function, which allows an attacker who can influence a site administrator to submit a forged request that modifies campaign settings. By exploiting this missing or incorrect nonce check, the attacker can inject malicious JavaScript that is saved in the database and executed whenever any visitor loads the affected page, resulting in a stored Cross‑Site Scripting vulnerability. This flaw is classified as CWE‑80.

All versions of the ValvePress WordPress Automatic Plugin up to and including 3.118.0 are impacted. The vulnerability applies to every WordPress site that installs any release of the plugin within that version range, regardless of additional configuration.

The CVSS score of 4.7 points to moderate severity, while the EPSS score of less than 1% reflects an unlikely exploitation scenario. The flaw is not listed in CISA’s KEV catalog. Exploitation requires the attacker to persuade an administrative user to click a crafted link or submit a forged form, but no administrative credentials are needed beforehand. Because the vulnerability allows the injection of persistent malicious content, the potential consequences include credential theft, defacement, or other attacks performed under the site owner’s authority, making remediation advisable despite the low expected exploitation likelihood.