The Xhanch – My Advanced Settings plugin lacks nonce validation in the settings update handler, enabling attackers to perform CSRF attacks without authentication. An attacker can forge a request that modifies plugin options such as the favicon URL or Google Analytics ID. Because the plugin outputs these values directly on the front‑end without escaping, the attack can chain into stored XSS, allowing script execution in the context of site visitors. The vulnerability therefore threatens confidentiality, integrity and potentially availability of the website by corrupting settings and injecting malicious code.

WordPress sites running the Xhanch – My Advanced Settings plugin, version 1.1.2 or earlier, from vendor xhanch_studio.

The CVSS score of 4.3 indicates moderate severity. Exploitation requires a user with administrative privileges to be tricked into clicking a crafted link; no authentication or privilege escalation is needed from the attacker. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the risk depends largely on user awareness and the presence of the affected plugin version. Overall the threat remains considerable for sites that rely on this plugin and have active administrators susceptible to social engineering.