The Vulnerability involves a Cross‑Site Request Forgery flaw on page 'lpaccordian' that allows unauthenticated attackers to send forged requests to the WordPress plugin. By bypassing nonce validation, an attacker can modify the plugin’s settings and insert malicious web scripts that are permanently stored. This leads to a stored Cross‑Site Scripting weakness, which can affect any site visitor who loads the modified page, potentially compromising user data and session integrity.

All installations of the Latest Post Accordian Slider plugin by anop‑goswami running any WordPress version up to and including 1.3 are affected. The vulnerability is present in every release within that version range and not limited to a specific minor build.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% points to a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. The likely attack vector is via a CSRF attack that convinces a site administrator to click a crafted link or perform a forged action. Once executed, the injected scripts will persist in the settings and be executed for all subsequent visitors to the affected pages.