The Reloadly reloadly‑topup‑widget plugin for WordPress contains a Cross‑Site Request Forgery flaw that can be abused to submit a crafted request on behalf of a user, resulting in a stored cross‑site scripting payload. Attacker‑controlled JavaScript can persist in the site data and run in the browsers of future visitors. The weakness is classified as CWE‑352.

The vulnerability affects the iseremet Reloadly reloadly‑topup‑widget plugin for WordPress. All releases up to and including version 2.0.1 are vulnerable. No patch version is listed in the information provided, so any installation of the plugin before 2.0.2 should be considered at risk.

The CVSS score of 7.1 indicates a medium‑to‑high severity attack. The EPSS score is reported as < 1%, implying that widespread exploitation is unlikely at this time, and the vulnerability is not included in the CISA KEV catalog. The attack vector is typical of CSRF flaws; it likely requires a legitimate session on the target site and the victim’s browser to be tricked into submitting a malicious request. This inference is based on common CSRF characteristics, as the input does not explicitly state the prerequisites for exploitation.