The WOLF WordPress plugin prior to version 1.1.0 contains a stored Cross-Site Scripting (CWE-79) vulnerability due to missing nonce and capability checks on an AJAX action. This flaw allows an unauthenticated attacker to craft a cross-site request that causes a logged-in administrator to unknowingly inject arbitrary content, including malicious scripts, into posts. The vulnerability also involves Cross-Site Request Forgery (CWE-352) aspects, enabling the attack vector. The CVSS v3.1 base score is 7.1 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute stored malicious scripts in the context of an administrator's browser session, potentially leading to theft of sensitive information, modification of content, or disruption of service. The vulnerability affects confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted content or links that could trigger AJAX requests in the WOLF plugin. Monitoring for updates from the plugin vendor is recommended.