The WPDeveloper Secret Meta plugin versions up to 1.2.1 contain a CSRF vulnerability that enables an attacker to perform unauthorized actions on behalf of an authenticated user. Additionally, the vulnerability allows reflected XSS attacks. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but user interaction is necessary. The vulnerability impacts confidentiality, integrity, and availability to a low degree each.

Successful exploitation could allow an attacker to trick an authenticated user into executing unwanted actions within the Secret Meta plugin, potentially leading to reflected XSS attacks. This could result in limited disclosure of information, modification of data, and disruption of service within the affected plugin context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided at this time. Until a fix is available, users should exercise caution with untrusted links and consider disabling or removing the affected plugin version if possible.