A Cross-Site Request Forgery vulnerability in the Shankaranand Maurya WP Content Protection plugin for WordPress enables attackers to inject malicious scripts via Stored XSS, posing a significant risk to site integrity.

This vulnerability is a Cross-Site Request Forgery (CWE-352) that triggers Stored Cross-Site Scripting. An unauthenticated attacker can trick an authenticated administrator into performing actions that lead to the execution of malicious scripts within the context of the WordPress dashboard.

Successful exploitation of this flaw allows an attacker to execute arbitrary JavaScript in the browser of a logged-in administrator. This can lead to full site compromise, unauthorized administrative actions, or the theft of sensitive session cookies, resulting in severe reputational damage and potential data loss. The CVSS score of 7.1 reflects a High severity due to the potential for unauthorized privilege escalation and persistent code execution.

Immediate Action: Since no specific patch version is currently identified, administrators should disable and remove the WP Content Protection plugin until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests to administrative endpoints and monitor site integrity for unexpected file modifications or injected script tags.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block suspicious requests and enforce strict CSRF protection rules to mitigate the impact of this vulnerability.

Public Exploit Available: exploit_available (unknown)

Given the potential for Stored XSS to lead to administrative account takeover, this vulnerability presents a substantial risk to WordPress environments. It is strongly recommended that organizations prioritize the removal of the vulnerable plugin immediately and continue to monitor vendor communication channels for a definitive fix.