The osTicket WP Bridge plugin for WordPress contains a flaw where a function performs missing or incorrect nonce validation, enabling an unauthenticated attacker to craft a forged request that updates plugin settings and stores malicious scripts in the site’s content. This stored Cross‑Site Scripting can occur once an administrator unknowingly submits the forged request, potentially compromising the confidentiality and integrity of all site visitors.

The vulnerability affects the osTicket WP Bridge plugin, developed by michaelbo, in all WordPress installations running any version up to and including 1.9.2. No newer versions are listed as affected, but the advisory does not provide an explicit fixed version beyond that limit.

The CVSS score of 6.1 reflects a moderate severity, while the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, and it requires an unauthenticated attacker to successfully trick a site administrator into executing a link that contains the forged request. Consequently, the potential impact is limited to the control of the administrator’s session and the site’s stored content, but the overall exploitation risk remains relatively low at present.