A cross‑site request forgery flaw in the Did Prestashop Display WordPress plugin enables an attacker to force an authenticated user to submit a malicious request that stores user‑input in the database. The stored data is later rendered without proper sanitization, creating a stored cross‑site scripting condition that can execute arbitrary JavaScript in the victim’s browser. The weakness is classified as CWE‑352.

The vulnerability affects all installations of the Did Prestashop Display plugin version 1.0.30 and earlier. Users deploying the plugin on any WordPress site are at risk, regardless of the site’s domain.

The CVSS score is 7.1, indicating a moderate‑to‑high severity. The EPSS score is below 1 %, so observed exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a CSRF request triggered by a malicious link or form that an attacker can get an authenticated user to click, enabling the attacker to inject persistent script data. Given the moderate severity and low exploit probability, the attack risk is moderate but should still be addressed promptly, especially for sites that expose the plugin’s endpoints to untrusted users.