The Ultimate Blogroll plugin for WordPress suffers from a missing or incorrectly implemented nonce validation, allowing attackers to perform Cross‑Site Request Forgery. An unauthenticated attacker can craft a forged request that, when a site administrator clicks a link, updates the plugin settings with arbitrary JavaScript. This stored script is executed whenever affected pages are viewed, potentially exposing admin credentials or user data to the attacker.

All versions of the Ultimate Blogroll plugin up to and including 2.5.2 performed by the vendor jensg are affected. Sites that have installed this plugin and still run 2.5.2 or earlier are at risk.

The CVSS score of 6.1 indicates a medium severity risk. The EPSS score of less than 1% suggests a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. However, the attack vector requires only a simple social‑engineering click from an administrator, making exploitation plausible if a target administrator is deceived. Without mitigations, the vulnerability could result in stolen credentials or compromised user sessions caused by the injected script.