The LockerPress – WordPress Security Plugin Up to 1.0 is missing or incorrectly validating a nonce on a function, allowing an unauthenticated attacker to send a forged request that updates plugin settings. This can inject malicious scripts into the site, resulting in stored cross‑site scripting that is executed when any user views the affected page. The weakness corresponds to CWE‑352, a Cross‑Site Request Forgery flaw that facilitates the exploit.

Any WordPress installation using LockerPress – WordPress Security Plugin version 1.0 or earlier is impacted. The vendor identified the entire product line up to that release as vulnerable.

The vulnerability carries a CVSS score of 6.1, indicating moderate severity. The EPSS score is less than 1%, implying low current exploitation probability. It is not listed in the CISA KEV catalog. The attack requires the victim to click a crafted link or form; thus it is a classic CSRF scenario, potentially exploitable by any attacker who can lure an administrator into taking a privileged action.