The Microsoft Clarity WordPress plugin versions up to and including 0.9.3 suffer from a CSRF vulnerability (CWE-352) because the edit_clarity_project_id() function lacks nonce validation. This flaw enables attackers to craft forged requests that, if executed by an authenticated site administrator, can alter the project ID and inject malicious JavaScript code. The vulnerability requires user interaction (UI:R) but no privileges (PR:N) and can impact confidentiality and integrity with no impact on availability, reflected in a CVSS 3.1 base score of 6.1.

Successful exploitation can lead to unauthorized modification of the Microsoft Clarity project ID and injection of malicious JavaScript code, potentially compromising site integrity and confidentiality. The attack requires tricking an authenticated administrator into performing an action, which limits the ease of exploitation. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted links or requests that could trigger changes in the Microsoft Clarity plugin settings. Monitoring for updates from Microsoft or the plugin maintainers is recommended.