The WP AutoBuzz plugin for WordPress contains a CSRF flaw that allows attackers to manipulate plugin settings, resulting in stored XSS. Attackers can craft a forged request containing a malicious script and trick an administrator into executing it. The exploit bypasses WordPress's DISALLOW_UNFILTERED_HTML protection because the data is written via update_option, outside of standard WordPress content sanitization.

All installations of WP AutoBuzz version 1.1.1 or earlier, maintained by godlessons, are affected. The flaw exists in the plugin layer of WordPress sites that use these versions.

The CVSS score for the vulnerability is 6.1, indicating moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a user interaction: the attacker must persuade a site administrator to click a crafted link or submit a form. Once this is achieved, the attacker can inject malicious scripts that persist on the site, potentially compromising site integrity.