The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to a Cross‑Site Request Forgery that can lead to Stored Cross‑Site Scripting. An attacker can craft a forged POST request that satisfies the plugin’s settings handler, which only checks for a specific flag in the payload and lacks nonce validation. Because the handler stores the supplied data without proper sanitization, malicious scripts can be persisted in the plugin’s settings. When an authenticated administrator later accesses a page that renders these settings, the injected scripts execute in the administrator’s browser, allowing the attacker to run arbitrary JavaScript in the context of the site and its users.

The flaw impacts the Inquiry Form to Posts or Pages plugin version 1.0 distributed by udamadu for WordPress. No other versions or products are listed as affected.

This vulnerability has a CVSS score of 4.3, indicating moderate severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog, suggesting limited exploitation evidence. The attack relies on the presence of a logged‑in administrator who is tricked into visiting a malicious page; an unauthenticated attacker can trigger the flaw via CSRF, but the need for a privileged victim reduces the overall risk compared to a publicly exploitable vulnerability. Nevertheless, the combination of CSRF and stored XSS can compromise site integrity if an attacker succeeds.