The Linux Promotional Plugin in WordPress is affected by a missing or improper nonce check on the plugin’s main admin page, allowing attackers to forge a request that updates plugin settings. The forged request can include malicious scripts that are then stored in the plugin configuration. The outcome is a stored cross‑site scripting vulnerability that compromises the integrity and appearance of the site and can be used to steal visitor credentials or deface content.

WordPress sites that use the timothyja:Linux Promotional Plugin plugin up to and including version 1.4 are impacted. All earlier releases of the plugin are also vulnerable.

The CVSS score of 6.1 indicates moderate severity. The EPSS score is below 1%, suggesting a low likelihood of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to entice a site administrator into clicking a crafted link or otherwise submitting a forged form to trigger the stored script. While the exploit requires a legitimate admin session, the compromised site can suffer defacement and potential credential theft through the injected script.