The WOLF WordPress plugin allows an unauthenticated attacker to send a crafted request that a logged‑in administrator happily processes, because the plugin does not perform a nonce or capability check on one of its AJAX actions. Based on the description, the vulnerability exploits a lack of security checks and relies on cross‑site request forgery to write arbitrary content, including malicious JavaScript, into a post. The stored XSS can be used to steal session cookies, deface the site, or redirect users. The weakness is identified as CWE‑352 (Cross‑Site Request Forgery) and CWE‑79 (Cross‑Site Scripting).

The flaw affects the WOLF Post Bulk Editor and Manager WordPress plugin versions older than 1.1.0, which is commonly installed on WordPress sites via the official repository or third‑party sources. Any WordPress installation that has this plugin installed and has not upgraded to 1.1.0 or later is vulnerable.

The CVSS base score of 7.1 classifies the issue as high severity. The EPSS score is below 1%, indicating a low current exploitation probability, and the vulnerability not listed in the CISA KEV catalog. Exploitation requires only that an unauthenticated attacker entice a privileged administrator to visit a crafted link or form—social engineering or a malicious link in email or comment could suffice. Once triggered, the attacker can embed arbitrary script in posts, compromising site integrity and potentially stealing user credentials.