The vulnerability allows an unauthenticated attacker to submit a forged request that bypasses nonce verification in the iTracker360 settings page. The input is not sanitized nor escaped, enabling the injection of arbitrary JavaScript that is stored in the 'itracker_license' field and executed whenever an administrator loads the settings form. This results in stored cross‑site scripting, which can compromise the confidentiality, integrity, and availability of the site for anyone who can view the page.

Version 2.2.0 and earlier of the iTracker360 WordPress plugin are affected. The flaw exists in the settings handling function that is present in all releases up to the specified version.

The CVSS score of 6.1 indicates moderate severity, but because the flaw relies on a CSRF token missing check, an attacker only needs to persuade an administrator to click a crafted link or submit a form. The EPSS score is unavailable and the vulnerability has not yet been catalogued by CISA, so the current attack likelihood may not be high. Nevertheless, if the site has an admin user who can be tricked, the stored XSS can lead to credential theft, session hijacking, or defacement.