The Tm‑WordPress Redirection plugin suffers from a missing or incorrect nonce check on the redirect configuration endpoint. This flaw allows an attacker who can lure an administrator to click a crafted URL to change the plugin’s settings. The victim’s browser subsequently loads malicious JavaScript stored in those settings, which runs with the administrator’s privileges against the site. The weakness is a classic Cross‑Site Request Forgery (CWE‑352) that leads to stored cross‑site scripting.

Any WordPress installation running the Tm‑WordPress Redirection plugin from vendor tienrocker with a version up to and including 1.2. No additional version ranges are specified beyond "up to 1.2".

The CVSS score of 6.1 classifies this vulnerability as medium severity. EPSS data are unavailable, so exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attacker must be able to convince an administrator to visit a malicious link, making the attack vector "user interaction". Because the plugin is widely used on publicly exposed WordPress sites, the potential impact could be a full compromise of the admin account should the stored script achieve privilege escalation or defacement.