The Mobile Site Redirect plugin contains a defect in nonce validation that permits Cross‑Site Request Forgery. An unauthenticated attacker can create a forged request that, if a site administrator clicks a malicious link while logged in, will modify plugin settings and inject arbitrary JavaScript. The injected script is stored and served to all site visitors, enabling confidentiality and integrity violations and potentially facilitating account takeover or data exfiltration. The weakness is identified as CWE‑352.

The vulnerability affects the WordPress plugin "Mobile Site Redirect" from vendor "webdevabq" for all releases up to and including version 1.2.1. No later versions are known to be affected. Sites running the plugin with administrative privileges are at risk.

The CVSS score of 6.1 places this vulnerability in the medium severity range. EPSS indicates a very low probability of exploitation (<1%) and the issue is not listed in the CISA KEV catalog. The attack requires a logged‑in administrator who clicks a crafted link, a typical CSRF vector, which makes the risk moderate yet significant if the attacker successfully injects persistent malicious scripts that affect many users.