The Automatic.css plugin has a stored cross‑site scripting flaw that allows an unauthenticated user to submit malicious requests containing the REQUEST_URI string. When the plugin ingests this data, it is stored and later rendered on the Activity Log settings page without proper escaping. An attacker who injects JavaScript can execute arbitrary code in the context of the administrator’s browser, potentially enabling credential theft, session hijacking, or full control over the WordPress site.

The vulnerability affects the Automatic.css WordPress plugin version 4.0.0. No other components are listed, and the flaw applies to all installations of this exact release.

The CVSS base score of 6.4 indicates a moderate impact, with the capability for an unauthenticated remote attacker to introduce payloads via the REQUEST_URI parameter. The EPSS score is not available, so current exploitation probability cannot be quantified, and the vulnerability is not yet listed in the CISA KEV catalog. The attack vector is presumed to be browser‑based and relies on the fact that administrators will visit the Activity Log page, making the flaw a priority for sites that rely on this feature.